last executing test programs: 9.290657425s ago: executing program 0 (id=1687): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000001000000fe8800000000000000000000000001010000000000000000000000000000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000400000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000078ef00000000000000000000000000000000000000000000000000000000000084010500ac1414aa0000000000000000000000000000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 8.779925789s ago: executing program 0 (id=1690): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000104000000000000000000000007", @ANYRES32=0x0, @ANYBLOB="0302000000000000140012800c0001006d6163766c616e0095e5028008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r1], 0x44}}, 0x0) 8.513812088s ago: executing program 3 (id=1692): unshare(0x20000400) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r0, 0x0, 0x0) 8.461909526s ago: executing program 0 (id=1694): r0 = socket$kcm(0x10, 0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007112c9000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x39c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r5 = socket(0x23, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r5, 0x6, 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000040)={0x24, r3, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_RETRY_LONG={0x5, 0x3e, 0xff}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xfa}]}, 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x801) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) 8.099557148s ago: executing program 3 (id=1698): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x4, &(0x7f0000000140)=ANY=[], &(0x7f0000000c40)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x47, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) (async) r1 = socket$alg(0x26, 0x5, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x8d, 0x8d, 0x4, [@fwd={0xc}, @fwd={0x8}, @fwd={0xf}, @datasec={0x4, 0x2, 0x0, 0xf, 0x1, [{0x1, 0x83000000, 0xff}, {0x5, 0x5, 0x7}], '*'}, @int={0x3, 0x0, 0x0, 0x1, 0x0, 0x2d, 0x0, 0x25, 0x6}, @int={0xe, 0x0, 0x0, 0x1, 0x0, 0x14, 0x0, 0x54, 0xfa63ad13c412e0ca}, @enum64={0xb, 0x1, 0x0, 0x13, 0x0, 0x8, [{0xd, 0x1d, 0x8}]}, @fwd={0x2}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000240)=""/79, 0xac, 0x4f, 0x1, 0x10000}, 0x28) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x2, 0x4, 0x4, 0x6, 0x10, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd, 0x2, 0x3}, 0x50) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r2, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x50) (async) sendmsg$qrtr(r4, 0x0, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) (async) r5 = accept$alg(r1, 0x0, 0x0) (async) unshare(0x24040000) unshare(0x2c020400) (async) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r6, 0x8) (async) r7 = accept4(r6, 0x0, 0x0, 0x0) sendto$inet(r7, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x1}, 0x8) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000180)={0x3, 0x2, 0x1000, &(0x7f0000001440)=""/4096}) (async) sendto$inet6(r7, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x7a}, 0x8) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x6}, 0x8) (async) recvmmsg(r5, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) 7.948500226s ago: executing program 0 (id=1699): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000010440)={'tunl0\x00', &(0x7f00000103c0)={'tunl0\x00', 0x0, 0x8, 0x700, 0x9, 0xfade, {{0x6, 0x4, 0x2, 0x2f, 0x18, 0x68, 0x0, 0x0, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xf}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@generic={0x83, 0x2}]}}}}}) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f0000001540)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000002c0)="99", 0x1}], 0x1}}, {{&(0x7f00000001c0)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000340)='v&U', 0x3}], 0x1}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x1, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb, r2}, 0x20) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) bind$rose(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x61d8, 0x0) socket$inet(0x2b, 0x801, 0x0) socket$packet(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) socket(0xa, 0x3, 0x3a) socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x20040000) r4 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000000)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) 7.654720259s ago: executing program 3 (id=1702): unshare(0x22020600) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x22}}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, 0x0, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000060000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000002124001180090001006d6574610000000014000280080003400000000008000240000009"], 0xa8}}, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r4, 0x89e7, &(0x7f0000000000)={0x200003a}) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x1a, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@local}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x114}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x4000041, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xe3cf}, 0x1c) 7.593467467s ago: executing program 4 (id=1703): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="ef00000000000100140012800b0001006970766c616e00000400028008000500", @ANYRES32=r1, @ANYBLOB="080004000001"], 0x4c}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) 6.794561914s ago: executing program 4 (id=1705): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000000000008500000044000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 6.622746228s ago: executing program 3 (id=1707): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000000000008500000044000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (fail_nth: 2) 5.564349746s ago: executing program 4 (id=1709): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x10, {{@in=@multicast1, @in=@remote, 0xfffe, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0x1, 0x0, 0x80}}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x34ff, 0x0, 0x2}, {{@in=@local, 0x0, 0x3c}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x800, 0x800}, {{@in6=@loopback, 0x30, 0x32}, 0x0, @in=@multicast1, 0x3503, 0x1}, {{@in6=@mcast1, 0x0, 0x33}, 0x0, @in=@private=0xa010101, 0x3504, 0x0, 0x0, 0x1, 0x0, 0xabf}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x32}, 0x0, @in6=@mcast2, 0x0, 0x1, 0x2, 0x0, 0x1}]}]}, 0x1fc}}, 0x0) 5.343764163s ago: executing program 4 (id=1710): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r2, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5b, 0x0, 0x0, 0x0, 0x0}}, 0x10) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x4, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x7}}, @NFT_MSG_NEWSETELEM={0x24, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x80}, 0x1, 0x0, 0x0, 0x890}, 0x40000) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001f00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x2, 0x1, "fa"}, 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000040)={r6, 0x2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000000000008500000044000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 4.990467692s ago: executing program 1 (id=1712): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000001000000fe8800000000000000000000000001010000000000000000000000000000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000400000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000078ef00000000000000000000000000000000000000000000000000000000000084010500ac1414aa0000000000000000000000000000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 4.891577376s ago: executing program 4 (id=1713): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) socket$kcm(0x2, 0x5, 0x84) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r6, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}}, 0x20}}, 0x4000054) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000829bd7000fedbdf253a000000080003009cdbe3e5b65c2d8c150f145c3f9ce88cc1cd1bc5d749194da4af6a54ea2beb706192a269c1062a18c06a58bc9a25e7a09f4f5780b0b7e35ed1b3ea65937393f51d9bec3f65caf471fb728dc9720b336ecb8c638bb8fc82f5b866aae6138090ce06815098f000a7e1e361d435c58755c063e711022224a4120e240f5ec48b7fbbdcabe8e12c827c2d3c65fc54c641c5c215cdae24a16087f8d8fa0e7103f4642dda688c1cb787fbd9eec624ba88d218620f4b1da090272528cfb2e0efa898948e69b7082575cece48dae6d741dfc666a5cbea5262f9a0a71ca1e476f48a8422d8d4a6bb9c50882839aa0a80894244777222f0b31fa83b88307dd397a0079617e08eaf0aff445e740014cd5fc23d45463b65d2e118b268aec6690ab126d6d5fcddb897f188d16c00c303bf305fee7c12c3b55c8c8299168ae0dc167ea493d83628405b76b54f6c9f2c27517e9658bdcb98fda88c18c2eb91ffc9c7017de977cd866456423e42d20898670c4cdeb611c9ad0f73d1472914f8f6de67dad3a6c5e8e89d23113a39cc9bc1f31803a4b88f70c296a8753abd9b1b164976904be265", @ANYRES32=r7, @ANYBLOB="0c00990001fcffff2f000000"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x40) r8 = getpid() r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x3c, r10, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) socketpair$unix(0x1, 0x5, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) r11 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r11, 0x0, 0x0) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) r12 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r12, 0x0, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000780), 0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r2}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000540)={r2, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@bridge_newneigh={0x2c, 0x1c, 0x8, 0x70bd2a, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@NDA_IFINDEX={0x8}, @NDA_SRC_VNI={0x8}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) 4.854185965s ago: executing program 1 (id=1714): syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) syz_emit_ethernet(0x9e, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x7c, 0x0, @wg=@data={0x4, 0x0, 0x0, "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600"/100}}}}}}, 0x0) 4.687518239s ago: executing program 1 (id=1715): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a000000290000", @ANYRES32=0x0, @ANYRES32=0x0], 0xb8}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b8000000190001000000001300000000e00000020000000000200000000000000000000000000000000002000000000000000000000000000a"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000029000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000020000000000000000000000000000900000000000000000000000000000000000000000000000200000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff07"], 0xb8}, 0x1, 0x0, 0x0, 0x20008800}, 0x10) 4.428754364s ago: executing program 1 (id=1716): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_QUERY(0x9, &(0x7f00000005c0)={@map=r1, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r2}, 0x10) 4.320316715s ago: executing program 2 (id=1717): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="b501000000000000bd110000000000008510000002000000850000007600800495000000000000009500a5050000000077d8f3b4000000002be16ad10a48b243ccc40806d25dfd73a015e0ca7fc2506a0f68a7d06d75357f21699cdc6751dfb265a0e3ccae669e173a649c1cfd6587d472d64e7cc955d77578f4c35235138d5421f9453559c35da860e8ef14142b2a3e314422b854421eed734ceb1efeecb9c66854c3b3ffe1b4ce25d7c983c005c03b1d1ca4cb3e26e7a23129d6606fd28a697a9d552af6d9a9df2c3af333e2008e11bbec0727cb3f647535deb6277f5696833a71011a7d06602e2fd5234712596b696418f163d1a13ed38a682f87925bfa753f631cd027edd68149ee99eebc6f7d6dd4ae59af7588c8e1f4efab57644ccb1973d7879b70a70001040000000000000000d7900a820b63278f4e9a217b98ef7042ad2a923132f208fd8289eaf8cd00000000000009d27d753a300800000000000000a5686f2fccc33e3e34c3969c5ad781302d40e97a8ad10ce0cbe17366d5ac6af2fca2360a15b80400d52040ef7b28d300747877e176fe4c4b8e40dbf260f5a9f7eee30293c1b163b795d0aef4deb851a30000f569dc8f39943f889008e1ec914faa9e6cd0b3b4b3b5db666ebeb49d6a62019d76459e70b459543c4ac42e53b4ad4c77cff373ebd95848f01864e456969cd28000170996016aceb583df5ee4dd722e8c350af489f9a900000000a0dcc391a65c674a9cce0439f832a20d7cbdcda5dff3ba92dd66afb9dcd3e7784dbea1e51a15b0f1a040cc63177f8fafa3192fc8e5552da1a982ab8dfe31ad1a0968faa47c2069d6bf09c3aa4f0fc128cb578d99b08a150b4cc4b22f6a464c6398c952519818a44a1b450ff502df87865c276588ea478e328e8277e811b99ce1acfecaf8e2c55ccc4b8eae0a61635514e99ffd438784060f23ba74c0b30b1180d935832deb686d789ba1d436d116394534e88492a42b8bcab12fcc661a2dc50b3a1dcfbc871e5c27e3d7260f6fa589e40000b89db451ff994845f6b49c12e89291398bcb3c06ef1289f74e0b0e2cab592d35f82a69e7284223a171c616b1f0fee6c4711d7aecb69746064d2c096554975d605ebe646302bf3d5cf32a9a09915ae3f3d4eb96615d7b237da56cd5e9904a19e145f25b6d98eb2c019967f553b61d0e80d6913cee9f8d18469a654a239a84a85debbc0284c5a5d51f0e115ab159e3b513a68284d2efc30587e433431b2896a3bd48020af67e9ac071b2dd6dc3b9efae4ff03558fa619aea909c7f2416e7e7da1c51ccc7e6ac27412f728dc6d80da8adf317ca863ed683897321f8c8bb5a5d953d6783b7a06353ee496bbdff418de3e53234df87756eb99e330253cf5da4aa1a9648a38f07e2d302b4165983db4f7b8972923fffa8c03c288512a3a38fbd7c816a44634f7a03fab30811b7b93257bea4369ba46024dee5e9b0b2c3d3324e9b7c1f99ab9bb3f498b1485373b79ec84a67dad4e37575dab87ce55a9a69ed856a4c4410d1242ac1bd1539094a641cc086c2c53e363beafc74ab4e9ff320373705cbf5644586ffe60d293944fa2d9dc18b55f1af5c42f27747bef1ffd0c1766f062d47d61bf9f64e6ee288fa7fc12d48da526527b9f5c318c93ec447cb8b5eee7aa8a1e85696af3dfef96657c0545c8ebd96528d9c28828e5befd80d684b03b6d153da3e3cbd3bfbf4a9375b8ad04a1d241bcb775505cb6cc7a44e2e24bd0b1ca4879caaff59d0ce39dc7f3fea447f4e46967855208e63ec988bd2692afefbed2b001205e4b30ee8fe417defa566a73ace8f01f7181de0ef25f1744896a3c38859e6148c42454949cd64b1a888e7fe9c2d86bb01023b6dde4ab67f5eb038af3e460c771518a4126c338b0390d459361e03adf6e6b558b3651a0e33d101b5febfff82794203da18db6fcf89715c2d338f78d8b9220171b418528f857a7cb79ca990de1208777e13faaa9b9cb9e67797b07d9eb9e909410b50c5d981d9a72aa36498b630519d1530ef0000000000000000000037fcffffffffffffff8db8379bd2044c652dff399a9f8bfa4e9c507f049d18837464276830461ee203ba51f6102d262fc9a26bc3638ecce24e65c55da6efaa462f03e0d36c62785f32ecc294a8c7a522b59f5a7b44d018cb2648383073d9e032492cae44350bc0a85697f431392eb22cae093e85954af97d6d7b2e6e8f43353062275ad1578a431594243452a2bfb89f91d8eaac00000000000080014573789425c4c22da528d89356aa6d2ae6da082e756c80cf39053431080ea6cbf9997a5a0ddad0b9d12bc3f880476ab32f0feaac5f16e61f7b72b8c9082eec423c6b3eaecfdcc9ec72795e7696421c83b76c2d6bac19bc875d009679778d8ef97d7e05329649d97b0dc54bea9b650873de2d3d702690176e0b23ee5cb5e469a8d1612d611722e6200e3a297d92f8e1de98326c5ef2b89d4e2d47767c0700783e5d865e373338e96ceb8399f296c59b2d70ca27735ecaff62982616d3ac1ab041733bce119d8002a6c8a2b08b32551b2313b1a2ff41b3f04af61c69c85cb2da48215727271bac2ffdeb62d9f5dc4845f1c3f63dc806e615ee8d28d6d7f181e30807afa27f41d0364c746a65a47464db68f3c433d88dd625db35fded2c86d75af88efaf20c8b37c644b6c4e773a9589200faa553bc92f916b75ddbfa18ab73979f46947b35914286d2499a0b8c970000000000000000f4fe74e0c26ab52329bd600627b256ca44dd121ffc8dbb6e5f70cbe03efccac70375b30cc927574d254d1b46c607e8b1ca7d1511568c4d885723734a3ef4b6b885f4582bdcef74e5e010627fc8e4fe00000000000000000000869d9640f06b11df2971909b90133983308ea4f033de613763f32d913bcbe9dd082a6fff197a20730269e6cfd31275395833f1c2b8a50a94c30cceae2a11fe9b9b835d0da73891c0b3ce22dea6bf31e7f51808cf72f44b4455b77a778440795e152dc1b7bb0a5636aa4742ce4d331a47de5836539cdf289176527277b70c8162aaf6f9475418b478329f3565450acfaf07000000eab8cabfa97e35081967bb92a264b07e8003d2f15537e72a1e4ca5ec1e2aaaf8236ecdefbaf512c75e636b6b6f518ad20521f909b12e9bc97e408e0dc82f950d12705f35708bc862196abb27e8d7991b5273987f38c4706289ff4f6130cee76465d487a07a74452f87da2029bd3debd9870335d58d3fe1ac809c227aa25842f75981bc6f569ffdb10ba3f20a86d95128d13e0c778998d3b3114bfb07bd61e4bff8a5e2ce4aa572c63e09b44ca4a181bcfe4eec3ce843c65c4948169fe639a186acc2b4a96c6b8d4d2e6d53ab97bea01eab953e6e89e3af34d4ada217bc6fda0fb2095c49195d0d6f365ca80a955b9ec81240a84ef672afa369fcd097728955cf04fec692b01fadfc8e3d444ba35d0f51a0065a3b982d09dfc6874fc0d8079b185447cb8a695e132d4d613a529d9c77e2a8f7320ecf698e8a2b170fd601dc1a9767a38b10788e92d1356f6a6c1bcfb2d31b46e735db13f1be80bac1b6be04fd98610000000000000000000000000000139af5493f74751c5e2501a4936bc4a0fa516117f4ccadc692003adee0a080eba2f1059660c0ee0e9aec72d4d0fe095632e4f641b0e34c611c5b3e0ba05fa36542d40837dda323910672a9097d68398fd3539686e4288db0d6bf7cb8a1835f46dfe11865a66ef47e736dada06677a5bca133d6cbc8fe5c4557e51b006bdccd7c5f32ff1d9e8b130f77df09236870fb3de5b87b4f8acc13df534eba329b86670000000000000000b27a2616c03cdf6c009447a652bca9b325e73c0737d5b717945e4fe7a169c5e2c54fc71a4104aa7cf0f5d30e2fcd9503650edbd8a5971a9a1fde5e5df37469ae204a6e899eacc1e63034cbabc5604739881cb82604bed3e53696a0606b26b879ef232a1a038291389593d1575cb79aa8284cf01a7e1a456acab9d8d608ad69d4c4b56492af7004e7ed9d47c5db3d76a00bea7c804f3a3638408bc1636f1009b7f185f51606918eaa0ab61a19"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 4.081579392s ago: executing program 1 (id=1718): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x23}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(r5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="02030003310000002cbd7000fbdbdf2502000900080000001c0000000000000005000600000000000a0000000000000000000000000000000000000000000001020000000000000002000100000000000000070c0000ff8005000500000000000a00000000000000fc0100000000000000000000000000010700000000000000210008000008"], 0x188}, 0x1, 0x7}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r8, &(0x7f00000000c0), 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r6, 0x58, &(0x7f0000000280)}, 0x10) sendmsg$can_bcm(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x4, 0x840, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{}, 0xfd, 0x0, 0x0, 0x0, "ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768a8284c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"}}, 0x80}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) accept$packet(r5, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000580)=0x14) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 3.876870178s ago: executing program 2 (id=1719): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@empty, 0xee24, 0x0, 0xffff, 0x3, 0x2}, {0x0, 0x200000004, 0x40000000007, 0x4, 0x100000003, 0x0, 0x200000003, 0xb}, {0x5, 0x0, 0x4, 0x3}, 0x5, 0x0, 0x1, 0x0, 0x6, 0x3}, {{@in=@remote, 0x10000, 0x6c}, 0x0, @in=@rand_addr=0x64010101, 0x3502, 0x2, 0x2, 0x0, 0x9075, 0x800, 0xc5e}}, 0xe8) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x8}}, 0x7}, 0x1c) 3.611333495s ago: executing program 3 (id=1720): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000900)=@newtfilter={0x370, 0x28, 0xd27, 0x1000004, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x6, 0x9}, {0x4}, {0xfff2, 0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x304, 0x2, [@TCA_FLOW_ACT={0x2e8, 0x9, 0x0, 0x1, [@m_vlan={0x128, 0x20, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}]}, {0xf2, 0x6, "97f52f282662cff1c4aa77545a36d102cb1a2547892f18dcf7b8f957940710f95215ab862714cd4748abe044a9b8d37e68d2cdd7570358fb641f6470640beadfbeded5debd41a0b4ac524ffc041d51479068192c25b93e35d3431bfeea288f8d9533f95d7ae68b1bef86c301bedb4f678d8e3c400f218177353ea3b3086902f50e733899f4798e049a05ac2f29f859ddf6859233176dec39543045fdcc29463b43312ebf190020725fc7640123530936647033e8a15e351383ed771b1275f1ca99a5592eeb5b4668d674d6c9aab6d187a005fd411318ee341c4eba599ea8dadb488906384f064888aba50fe913b1"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_mpls={0x9c, 0xc, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5}, @TCA_MPLS_TTL={0x5, 0x7, 0x7}]}, {0x5f, 0x6, "80a3fdc945523b7d9976ed692f3377d1485193494babdf312eef2c9bec88940ce97a04d39ed9a23a46609cccb9bca69ff148d20fe7d0de11f50f693ff9936bc501ad0d1b3d9654c63ea8d7a0a6d160be2ed340451f084935cf2214"}, {0xc}, {0xc, 0x8, {0x5}}}}, @m_ctinfo={0x60, 0x8, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x65d2060d}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x6}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x8}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_skbedit={0xc0, 0x2, 0x0, 0x0, {{0xc}, {0x44, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x4b0, 0x6, 0x0, 0x1000, 0xf}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x46}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x0, 0x1, 0x5, 0x9}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x100}]}, {0x54, 0x6, "129e934384f939893a14b5652ee1a3e1d084b1d4bf6e31e9bc70b67383c579ba928fa274f960ffdc802d8292c4f357eba16141b6a89b89e95848747661b7c892c6c1256fcf050aaf75fe93f05fe36c64"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_FLOW_ADDEND={0x8, 0x5, 0x3}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x80}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x7bf1}]}}, @TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_CHAIN={0x8, 0xb, 0x10}, @filter_kind_options=@f_matchall={{0xd}, {0x1c, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x9, 0xffe0}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xb}}]}}]}, 0x370}}, 0x4000) 3.464393274s ago: executing program 2 (id=1721): unshare(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000c0000000800060040020000080005000000006f"], 0x2c}}, 0x810) sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r5, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xe382}]}, 0x44}}, 0x40) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000040000000c0000000b"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000ecff850000000400000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r7}, 0x18) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000003800)=@newtaction={0x14, 0x30, 0x12f}, 0x14}}, 0xc0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x70bd2e, 0x2, {}, [@ETHTOOL_A_COALESCE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8, 0x3, 0xffd}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x144}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000400000003000006040000000400000007000000020000000400000004000000fcffffff002e71a061"], 0x0, 0x45, 0x0, 0x1, 0x80000001}, 0x28) r10 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r10, 0x0, 0x0) 589.505307ms ago: executing program 2 (id=1722): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000ac0)={0x3, &(0x7f0000000a80)=[{0x40}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x16, 0x7, 0x6, 0x1}]}, 0x10) sendmmsg(r0, &(0x7f0000003180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206050000000000000000000700000014000780080011400000004008001240fcfffeff0500010006000000050005000200000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b00"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x4000400) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1e000000e77300008f0000000500000000000100", @ANYRES32, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400000003000000000000000d0020000000000de84e1ae9659d527c771f6993b52f79ca50347a7755db42a8e23b0fc487201b6b18c0572f7c07a8526bc5c9f30000000000", @ANYRES32, @ANYBLOB], 0x50) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x6}]}, 0x10) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240}, 0x94) r6 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) ioctl$F2FS_IOC_COMPRESS_FILE(r5, 0xf518, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x4000) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x102, 0x0) ioctl$PPPIOCATTCHAN(r7, 0x40047438, &(0x7f0000000040)=0x1) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r7, 0xf501, 0x0) accept4(r2, 0x0, &(0x7f0000000300), 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000002) ioctl$sock_SIOCADDRT(r4, 0x890b, &(0x7f0000000140)={0x0, @hci={0x1f, 0x0, 0x3}, @generic={0x2b, "0f97c644e8078d70c0803344171e"}, @phonet={0x23, 0x4, 0xa, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000340)='sit0\x00', 0xe20, 0x5, 0x3}) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="020000000400000008000000010000", @ANYRES32, @ANYRESOCT=r6, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES16=r1], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00efffffffffffffff00000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca9000000000000000000950000000000000075090200020000007b9a00fe00000000b509000000000000c39a04fef1000000bf8700000000000007080000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182900000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 547.856885ms ago: executing program 1 (id=1723): unshare(0x22020600) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$AUTOFS_IOC_FAIL(r1, 0x9361, 0x800) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000003c0)={r3, 0xfff9, 0x2, 0x0, 0xe, 0x2}, &(0x7f0000000400)=0x14) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) 546.848992ms ago: executing program 3 (id=1724): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x1b32, 0x4) sendto$inet(r0, &(0x7f0000000540)='v', 0x1, 0x4040, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=""/53, 0x35}, 0x40001}], 0x1, 0x40012080, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2c, 0x40, 0x107, 0x70bd2b, 0x0, {0x6, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x123}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x4, 0x0, 0x0, @pid}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x3c, r3, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@GTPA_LINK={0x8, 0x1, r4}, @GTPA_LINK={0x8}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_TID={0xc, 0x3, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x60) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000000)='bridge0\x00') 304.77238ms ago: executing program 2 (id=1725): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010000104feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="8a4502000000000024001280090001fd626f6e64dc0000001400028005002100000200", @ANYRES32=0x0, @ANYBLOB], 0x44}}, 0x40) unshare(0x20000) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010000104feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="8a4502000000000024001280090001fd626f6e64dc0000001400028005002100000200", @ANYRES32=0x0, @ANYBLOB], 0x44}}, 0x40) (async) unshare(0x20000) (async) 295.600069ms ago: executing program 0 (id=1726): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1e, 0x17, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000000ad96850000001700000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000030000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x41, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r6, 0x84, 0x71, &(0x7f0000000000)={r5, 0xae}, &(0x7f0000000040)=0x8) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) sendmmsg$inet6(r3, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x12, @local, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="f8", 0x1}], 0x1}, 0x2c01}], 0x1, 0x4c851) 241.145011ms ago: executing program 4 (id=1727): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r1, 0x8b2c, &(0x7f0000000040)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x337) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000000000008500000044000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r3, 0x0, 0x3a, 0x38, &(0x7f0000000000)="5691851d6affefbc60e015158f66439a670e571b7f74309976f84e59b00d7f81d43b748671d546e3fbb12bf18094d9c333b00c6ffee9d8c1977c", &(0x7f0000000040)=""/56, 0x8, 0x0, 0x11, 0x62, &(0x7f0000000080)="89537e1f7994aa019fe9421136c878436e", &(0x7f00000000c0)="17c7745f5ffe16c75ec52508676f62d8b0fb8f8a7ecaab570706f0538aca5abfac7f6ef9c44be5307951cef5a04584f3d9180f2e3f64aa83caee990afd3887bd68a8ba1927685ffab1c6905d8a0d78ef517f4646a490064d26f7c7b19a0856067b93", 0x2, 0x0, 0x8}, 0x50) 84.053502ms ago: executing program 0 (id=1728): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x1c, 0x3, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048004}, 0x4040000) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYRES8=r0], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r3}, 0x10) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r4, 0x0, 0xd0, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="11000000040000000400000009"], 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r7}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r8, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)=r7}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r8}, &(0x7f0000000000), &(0x7f00000000c0)=r9}, 0x20) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r6, r10, 0x4, 0x0, @val=@tracing={0x0, 0x1}}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000062010c000000800095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) close(r2) 0s ago: executing program 2 (id=1729): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x4000, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) shutdown(r0, 0x1) kernel console output (not intermixed with test programs): er0: entered allmulticast mode [ 111.494060][ T6625] tipc: Started in network mode [ 111.508699][ T6625] tipc: Node identity 9609251235e5, cluster identity 4711 [ 111.527836][ T6625] tipc: Enabled bearer , priority 0 [ 111.550045][ T6623] tipc: Resetting bearer [ 111.641349][ T6623] tipc: Disabling bearer [ 111.909981][ T6648] netlink: 4 bytes leftover after parsing attributes in process `syz.3.226'. [ 111.924555][ T6645] netlink: 4 bytes leftover after parsing attributes in process `syz.1.224'. [ 111.925109][ T6649] netlink: 'syz.2.225': attribute type 1 has an invalid length. [ 111.962649][ T6648] bridge0: entered promiscuous mode [ 111.977698][ T6648] macvlan2: entered allmulticast mode [ 111.986171][ T6648] bridge0: entered allmulticast mode [ 111.993483][ T6648] bridge0: port 3(macvlan2) entered blocking state [ 112.002293][ T6648] bridge0: port 3(macvlan2) entered disabled state [ 112.013506][ T6648] bridge0: left allmulticast mode [ 112.018972][ T6648] bridge0: left promiscuous mode [ 112.054051][ T6645] bridge0: entered promiscuous mode [ 112.059864][ T6645] macvlan2: entered allmulticast mode [ 112.065263][ T6645] bridge0: entered allmulticast mode [ 112.081936][ T6645] bridge0: port 3(macvlan2) entered blocking state [ 112.091407][ T6658] netlink: 84 bytes leftover after parsing attributes in process `syz.2.225'. [ 112.095902][ T6645] bridge0: port 3(macvlan2) entered disabled state [ 112.116561][ T6645] bridge0: left allmulticast mode [ 112.121770][ T6645] bridge0: left promiscuous mode [ 112.274518][ T6649] 8021q: adding VLAN 0 to HW filter on device bond5 [ 112.595382][ T6675] tipc: Enabled bearer , priority 0 [ 112.627182][ T6675] syzkaller0: entered promiscuous mode [ 112.674358][ T6675] syzkaller0: entered allmulticast mode [ 112.839915][ T6686] tipc: Resetting bearer [ 112.921486][ T6699] netlink: 28 bytes leftover after parsing attributes in process `syz.1.239'. [ 113.162892][ T6673] tipc: Resetting bearer [ 113.195098][ T6673] tipc: Disabling bearer [ 113.381582][ T6713] Cannot find add_set index 2 as target [ 113.454227][ T6716] netlink: 'syz.0.242': attribute type 1 has an invalid length. [ 113.475133][ T6714] netlink: 236 bytes leftover after parsing attributes in process `syz.3.241'. [ 113.593652][ T6726] netlink: 84 bytes leftover after parsing attributes in process `syz.0.242'. [ 113.692761][ T6716] 8021q: adding VLAN 0 to HW filter on device bond3 [ 113.944013][ T6741] netlink: 'syz.1.247': attribute type 1 has an invalid length. [ 114.055467][ T6741] 8021q: adding VLAN 0 to HW filter on device bond3 [ 114.129356][ T6741] netlink: 84 bytes leftover after parsing attributes in process `syz.1.247'. [ 114.217210][ T6751] syzkaller0: entered promiscuous mode [ 114.245706][ T6751] syzkaller0: entered allmulticast mode [ 114.506465][ T6763] netlink: 28 bytes leftover after parsing attributes in process `syz.3.256'. [ 114.760787][ T6768] netlink: 'syz.4.258': attribute type 1 has an invalid length. [ 114.889004][ T6781] netlink: 84 bytes leftover after parsing attributes in process `syz.4.258'. [ 114.928408][ T6775] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 114.930360][ T6768] 8021q: adding VLAN 0 to HW filter on device bond2 [ 115.623638][ T6814] netlink: 'syz.4.271': attribute type 1 has an invalid length. [ 115.710139][ T6818] netlink: 28 bytes leftover after parsing attributes in process `syz.0.272'. [ 115.775238][ T6823] netlink: 84 bytes leftover after parsing attributes in process `syz.4.271'. [ 115.903704][ T6814] 8021q: adding VLAN 0 to HW filter on device bond3 [ 116.059014][ T6839] netlink: 'syz.1.276': attribute type 1 has an invalid length. [ 116.170556][ T6848] netlink: 84 bytes leftover after parsing attributes in process `syz.1.276'. [ 116.206542][ T6839] 8021q: adding VLAN 0 to HW filter on device bond4 [ 116.419307][ T6851] bond6: option updelay: invalid value (18446744071562067969) [ 116.423738][ T6853] openvswitch: netlink: Missing valid actions attribute. [ 116.448328][ T6853] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 116.463045][ T6851] bond6: option updelay: allowed values 0 - 2147483647 [ 116.528374][ T6858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.282'. [ 116.719532][ T6851] bond6 (unregistering): Released all slaves [ 117.185183][ T6864] batman_adv: batadv0: Adding interface: vlan3 [ 117.203547][ T6864] batman_adv: batadv0: The MTU of interface vlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.236597][ T6887] netlink: 'syz.1.290': attribute type 1 has an invalid length. [ 117.357820][ T6893] netlink: 84 bytes leftover after parsing attributes in process `syz.1.290'. [ 117.423147][ T6864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.475860][ T6897] netlink: 4 bytes leftover after parsing attributes in process `syz.0.292'. [ 117.487438][ T6864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.499112][ T6864] batman_adv: batadv0: Not using interface vlan3 (retrying later): interface not active [ 117.583468][ T6887] 8021q: adding VLAN 0 to HW filter on device bond5 [ 117.606487][ T6897] bridge0: entered promiscuous mode [ 117.611897][ T6897] macvlan2: entered allmulticast mode [ 117.619191][ T6897] bridge0: entered allmulticast mode [ 117.626180][ T6897] bridge0: port 3(macvlan2) entered blocking state [ 117.632949][ T6897] bridge0: port 3(macvlan2) entered disabled state [ 117.644916][ T6897] bridge0: left allmulticast mode [ 117.650088][ T6897] bridge0: left promiscuous mode [ 117.655796][ T6901] netlink: 'syz.4.293': attribute type 1 has an invalid length. [ 117.700769][ T6901] 8021q: adding VLAN 0 to HW filter on device bond4 [ 117.733818][ T6901] netlink: 84 bytes leftover after parsing attributes in process `syz.4.293'. [ 117.971743][ T6910] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 117.980091][ T6910] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 118.462735][ T6933] netlink: 24 bytes leftover after parsing attributes in process `syz.3.303'. [ 118.612136][ T6943] netlink: 4 bytes leftover after parsing attributes in process `syz.4.304'. [ 118.667536][ T6943] bridge0: entered promiscuous mode [ 118.687328][ T6943] macvlan2: entered allmulticast mode [ 118.707472][ T6943] bridge0: entered allmulticast mode [ 118.745746][ T6943] bridge0: port 3(macvlan2) entered blocking state [ 118.772657][ T6943] bridge0: port 3(macvlan2) entered disabled state [ 118.820855][ T6943] bridge0: left allmulticast mode [ 118.844542][ T6943] bridge0: left promiscuous mode [ 119.120644][ T6965] netlink: 'syz.1.310': attribute type 1 has an invalid length. [ 119.161987][ T1210] IPVS: starting estimator thread 0... [ 119.237566][ T6965] 8021q: adding VLAN 0 to HW filter on device bond6 [ 119.258275][ T6969] IPVS: using max 27 ests per chain, 64800 per kthread [ 120.169865][ T7003] tipc: Started in network mode [ 120.187233][ T7003] tipc: Node identity f6b85d603355, cluster identity 4711 [ 120.195225][ T7003] tipc: Enabled bearer , priority 0 [ 120.237142][ T7008] syzkaller0: entered promiscuous mode [ 120.254264][ T7008] syzkaller0: entered allmulticast mode [ 120.451287][ T7008] tipc: Resetting bearer [ 120.634996][ T7023] __nla_validate_parse: 5 callbacks suppressed [ 120.635016][ T7023] netlink: 28 bytes leftover after parsing attributes in process `syz.1.326'. [ 120.845665][ T7031] netlink: 'syz.2.328': attribute type 1 has an invalid length. [ 120.927964][ T7031] 8021q: adding VLAN 0 to HW filter on device bond6 [ 120.954568][ T7031] netlink: 84 bytes leftover after parsing attributes in process `syz.2.328'. [ 121.020063][ T7042] netlink: 36 bytes leftover after parsing attributes in process `syz.1.332'. [ 121.029279][ T7042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.332'. [ 121.162733][ T7044] netlink: 'syz.4.331': attribute type 12 has an invalid length. [ 121.172304][ T7001] tipc: Resetting bearer [ 121.191228][ T7048] netlink: 36 bytes leftover after parsing attributes in process `syz.1.332'. [ 121.209462][ T7048] netlink: 8 bytes leftover after parsing attributes in process `syz.1.332'. [ 121.248303][ T7001] tipc: Disabling bearer [ 121.836810][ T7058] netlink: 84 bytes leftover after parsing attributes in process `syz.2.334'. [ 121.936212][ T7064] netlink: 'syz.0.336': attribute type 13 has an invalid length. [ 122.398246][ T7079] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.552693][ T7079] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.682151][ T7079] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.815875][ T7094] netlink: 'syz.2.344': attribute type 1 has an invalid length. [ 122.924672][ T7079] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.944438][ T7103] netlink: 84 bytes leftover after parsing attributes in process `syz.2.344'. [ 122.995973][ T7094] 8021q: adding VLAN 0 to HW filter on device bond7 [ 123.140318][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.205388][ T7112] netlink: 28 bytes leftover after parsing attributes in process `syz.0.349'. [ 123.256008][ T6155] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.371067][ T6155] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.453971][ T6155] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.771546][ T7128] netlink: 32 bytes leftover after parsing attributes in process `syz.0.355'. [ 124.419657][ T7164] netlink: 'syz.3.364': attribute type 1 has an invalid length. [ 124.580026][ T7164] 8021q: adding VLAN 0 to HW filter on device bond1 [ 124.633915][ T7167] bond1: (slave ip6erspan0): making interface the new active one [ 124.657242][ T7167] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 126.130009][ T7242] netlink: 'syz.1.387': attribute type 1 has an invalid length. [ 126.276142][ T7247] __nla_validate_parse: 4 callbacks suppressed [ 126.276163][ T7247] netlink: 84 bytes leftover after parsing attributes in process `syz.3.389'. [ 126.373764][ T7248] netlink: 84 bytes leftover after parsing attributes in process `syz.1.387'. [ 126.426780][ T7242] 8021q: adding VLAN 0 to HW filter on device bond7 [ 126.551730][ T7254] netlink: 84 bytes leftover after parsing attributes in process `syz.0.390'. [ 126.600737][ T7243] lo: entered promiscuous mode [ 127.077683][ T7271] netlink: 'syz.4.398': attribute type 1 has an invalid length. [ 127.231200][ T7271] netlink: 4 bytes leftover after parsing attributes in process `syz.4.398'. [ 127.285099][ T7275] bond5: (slave veth5): Enslaving as an active interface with a down link [ 127.313225][ T7277] netlink: 'syz.1.400': attribute type 3 has an invalid length. [ 127.344371][ T7277] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 127.359663][ T7287] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 127.384479][ T7286] netlink: 28 bytes leftover after parsing attributes in process `syz.0.402'. [ 127.792272][ T7301] netlink: 4 bytes leftover after parsing attributes in process `syz.1.404'. [ 127.824129][ T7302] Bluetooth: MGMT ver 1.23 [ 127.901721][ T7309] netlink: 'syz.2.408': attribute type 1 has an invalid length. [ 127.918360][ T7310] netlink: 84 bytes leftover after parsing attributes in process `syz.4.409'. [ 127.941504][ T7309] netlink: 84 bytes leftover after parsing attributes in process `syz.2.408'. [ 128.334680][ T7324] netlink: 8 bytes leftover after parsing attributes in process `syz.3.414'. [ 128.565049][ T7333] netlink: 28 bytes leftover after parsing attributes in process `syz.3.417'. [ 129.039271][ T7351] ip6t_rpfilter: unknown options [ 129.393353][ T7367] netlink: 'syz.0.430': attribute type 1 has an invalid length. [ 129.722159][ T7383] bridge0: entered promiscuous mode [ 129.773870][ T7383] macvlan2: entered allmulticast mode [ 129.781018][ T7383] bridge0: entered allmulticast mode [ 129.790988][ T7383] bridge0: port 3(macvlan2) entered blocking state [ 129.798799][ T7383] bridge0: port 3(macvlan2) entered disabled state [ 129.811434][ T7383] bridge0: left allmulticast mode [ 129.829782][ T7383] bridge0: left promiscuous mode [ 129.921350][ T7387] tipc: Enabled bearer , priority 0 [ 129.935518][ T7387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 129.971769][ T7386] tipc: Disabling bearer [ 130.181344][ T7395] netlink: 'syz.4.442': attribute type 3 has an invalid length. [ 130.279786][ T7399] netlink: 'syz.4.444': attribute type 1 has an invalid length. [ 130.373333][ T7405] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 130.748244][ T7419] bridge0: entered promiscuous mode [ 130.754774][ T7419] macvlan2: entered allmulticast mode [ 130.795255][ T7419] bridge0: entered allmulticast mode [ 130.813585][ T7419] bridge0: port 3(macvlan2) entered blocking state [ 130.826584][ T7419] bridge0: port 3(macvlan2) entered disabled state [ 130.846750][ T7419] bridge0: left allmulticast mode [ 130.851876][ T7419] bridge0: left promiscuous mode [ 130.887624][ T7428] netlink: 'syz.3.453': attribute type 1 has an invalid length. [ 130.947755][ T7427] netlink: 'syz.4.452': attribute type 13 has an invalid length. [ 130.955717][ T7427] netlink: 'syz.4.452': attribute type 17 has an invalid length. [ 131.159608][ T7427] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 131.214241][ T7421] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.322420][ T7421] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.733691][ T7464] __nla_validate_parse: 13 callbacks suppressed [ 131.733710][ T7464] netlink: 28 bytes leftover after parsing attributes in process `syz.2.464'. [ 131.824327][ T7469] netlink: 4 bytes leftover after parsing attributes in process `syz.3.466'. [ 131.868193][ T7469] bridge0: entered promiscuous mode [ 131.873691][ T7469] macvlan2: entered allmulticast mode [ 131.882357][ T7469] bridge0: entered allmulticast mode [ 131.891788][ T7469] bridge0: port 3(macvlan2) entered blocking state [ 131.902671][ T7469] bridge0: port 3(macvlan2) entered disabled state [ 131.914322][ T7469] bridge0: left allmulticast mode [ 131.920278][ T7469] bridge0: left promiscuous mode [ 132.781593][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.795693][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.233094][ T7517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.481'. [ 133.316979][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.484'. [ 133.512144][ T7532] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.486'. [ 133.608053][ T7517] syz.4.481 (7517) used greatest stack depth: 17832 bytes left [ 134.006644][ T7556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.495'. [ 134.091823][ T7556] bridge0: entered promiscuous mode [ 134.124995][ T7556] macvlan2: entered allmulticast mode [ 134.129418][ T7562] netlink: 28 bytes leftover after parsing attributes in process `syz.4.497'. [ 134.142010][ T7556] bridge0: entered allmulticast mode [ 134.155837][ T7556] bridge0: port 3(macvlan2) entered blocking state [ 134.165495][ T7556] bridge0: port 3(macvlan2) entered disabled state [ 134.186920][ T7556] bridge0: left allmulticast mode [ 134.192248][ T7556] bridge0: left promiscuous mode [ 134.949147][ T7595] veth0_to_bridge: entered promiscuous mode [ 135.081275][ T7595] ieee802154 phy0 wpan0: encryption failed: -22 [ 135.094134][ T7595] netlink: 24 bytes leftover after parsing attributes in process `syz.2.510'. [ 135.119949][ T7605] netlink: 4 bytes leftover after parsing attributes in process `syz.0.513'. [ 135.142072][ T7605] bridge0: entered promiscuous mode [ 135.148762][ T7605] macvlan2: entered allmulticast mode [ 135.154531][ T7605] bridge0: entered allmulticast mode [ 135.171240][ T7605] bridge0: port 3(macvlan2) entered blocking state [ 135.179973][ T7605] bridge0: port 3(macvlan2) entered disabled state [ 135.201215][ T7605] bridge0: left allmulticast mode [ 135.208029][ T7605] bridge0: left promiscuous mode [ 135.274188][ T7608] netlink: 64 bytes leftover after parsing attributes in process `syz.1.514'. [ 135.339468][ T7594] veth0_to_bridge: left promiscuous mode [ 135.696039][ T7623] bridge_slave_0: left allmulticast mode [ 135.701809][ T7623] bridge_slave_0: left promiscuous mode [ 135.737736][ T7623] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.829149][ T7623] bridge_slave_1: left allmulticast mode [ 135.834864][ T7623] bridge_slave_1: left promiscuous mode [ 135.865908][ T7623] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.921215][ T7623] bond0: (slave bond_slave_0): Releasing backup interface [ 135.981525][ T7623] bond0: (slave bond_slave_1): Releasing backup interface [ 136.026407][ T7640] netlink: 'syz.2.525': attribute type 1 has an invalid length. [ 136.031839][ T7623] team0: Port device team_slave_0 removed [ 136.073371][ T7623] team0: Port device team_slave_1 removed [ 136.082843][ T7623] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 136.092031][ T7623] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 136.103511][ T7623] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 136.111868][ T7623] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 136.124442][ T7623] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 136.254624][ T7640] 8021q: adding VLAN 0 to HW filter on device bond8 [ 136.333254][ T7656] lo: Caught tx_queue_len zero misconfig [ 136.362009][ T7657] netdevsim netdevsim0: Direct firmware load for þ failed with error -2 [ 136.388981][ T7657] netdevsim netdevsim0: Falling back to sysfs fallback for: þ [ 136.569537][ T7669] bond0: Caught tx_queue_len zero misconfig [ 136.774195][ T7676] __nla_validate_parse: 8 callbacks suppressed [ 136.774214][ T7676] netlink: 84 bytes leftover after parsing attributes in process `syz.3.533'. [ 137.419984][ T7702] netlink: 4 bytes leftover after parsing attributes in process `syz.2.545'. [ 137.489257][ T7702] bridge0: entered promiscuous mode [ 137.515895][ T7702] macvlan2: entered allmulticast mode [ 137.521477][ T7702] bridge0: entered allmulticast mode [ 137.530507][ T7702] bridge0: port 3(macvlan2) entered blocking state [ 137.545878][ T7702] bridge0: port 3(macvlan2) entered disabled state [ 137.592497][ T7702] bridge0: left allmulticast mode [ 137.598604][ T7702] bridge0: left promiscuous mode [ 137.739226][ T7715] netlink: 'syz.0.548': attribute type 1 has an invalid length. [ 137.774163][ T7715] netlink: 84 bytes leftover after parsing attributes in process `syz.0.548'. [ 138.161127][ T7725] netdevsim netdevsim3: Direct firmware load for þ failed with error -2 [ 138.177304][ T7725] netdevsim netdevsim3: Falling back to sysfs fallback for: þ [ 138.219119][ T7726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.554'. [ 138.682769][ T7739] tipc: New replicast peer: 255.255.255.255 [ 138.689776][ T7739] tipc: Enabled bearer , priority 10 [ 138.700974][ T7739] netlink: 'syz.0.559': attribute type 11 has an invalid length. [ 138.710322][ T7739] netlink: 'syz.0.559': attribute type 11 has an invalid length. [ 138.745082][ T7739] netlink: 224 bytes leftover after parsing attributes in process `syz.0.559'. [ 139.241685][ T7756] netlink: 28 bytes leftover after parsing attributes in process `syz.0.563'. [ 139.404763][ T7764] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 139.519197][ T7775] netlink: 84 bytes leftover after parsing attributes in process `syz.3.569'. [ 139.705692][ T10] tipc: Node number set to 3320667488 [ 139.844396][ T7787] netlink: 4 bytes leftover after parsing attributes in process `syz.0.573'. [ 139.892907][ T7787] bridge0: entered promiscuous mode [ 139.908667][ T7787] macvlan2: entered allmulticast mode [ 139.922091][ T7787] bridge0: entered allmulticast mode [ 139.954941][ T7787] bridge0: port 3(macvlan2) entered blocking state [ 139.984487][ T7787] bridge0: port 3(macvlan2) entered disabled state [ 140.047391][ T7787] bridge0: left allmulticast mode [ 140.060251][ T7787] bridge0: left promiscuous mode [ 140.442612][ T7799] netlink: 28 bytes leftover after parsing attributes in process `syz.3.578'. [ 140.647210][ T7807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.580'. [ 140.726825][ T7807] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -12 [ 140.791716][ T7807] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -12 [ 140.820638][ T7807] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 140.913493][ T7819] warning: `syz.0.582' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 141.106943][ T7826] netlink: 'syz.1.584': attribute type 1 has an invalid length. [ 141.285175][ T7826] 8021q: adding VLAN 0 to HW filter on device bond8 [ 141.338239][ T7840] batadv0: entered promiscuous mode [ 141.345285][ T7840] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 141.354990][ T7840] batadv0: left promiscuous mode [ 141.744446][ T7855] bridge0: entered promiscuous mode [ 141.756936][ T7855] macvlan2: entered allmulticast mode [ 141.772582][ T7855] bridge0: entered allmulticast mode [ 141.793186][ T7855] bridge0: port 1(macvlan2) entered blocking state [ 141.825782][ T7855] bridge0: port 1(macvlan2) entered disabled state [ 141.853048][ T7855] bridge0: left allmulticast mode [ 141.861793][ T7864] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20000 [ 141.864188][ T7855] bridge0: left promiscuous mode [ 142.522250][ T7883] __nla_validate_parse: 7 callbacks suppressed [ 142.522269][ T7883] netlink: 32 bytes leftover after parsing attributes in process `syz.1.603'. [ 142.572886][ T7883] netlink: 'syz.1.603': attribute type 1 has an invalid length. [ 142.635223][ T7891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.606'. [ 142.655806][ T7890] netlink: 8 bytes leftover after parsing attributes in process `syz.3.606'. [ 142.668300][ T7888] netlink: 28 bytes leftover after parsing attributes in process `syz.2.604'. [ 142.904309][ T7903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.609'. [ 142.993395][ T7903] bridge0: entered promiscuous mode [ 143.007018][ T7903] macvlan2: entered allmulticast mode [ 143.040034][ T7903] bridge0: entered allmulticast mode [ 143.079772][ T7903] bridge0: port 3(macvlan2) entered blocking state [ 143.113904][ T7903] bridge0: port 3(macvlan2) entered disabled state [ 143.140898][ T7909] netlink: 28 bytes leftover after parsing attributes in process `syz.2.611'. [ 143.164541][ T7903] bridge0: left allmulticast mode [ 143.181098][ T7903] bridge0: left promiscuous mode [ 143.219792][ T7909] netlink: 84 bytes leftover after parsing attributes in process `syz.2.611'. [ 143.233360][ T7914] netlink: 'syz.1.612': attribute type 1 has an invalid length. [ 143.279897][ T7914] netlink: 84 bytes leftover after parsing attributes in process `syz.1.612'. [ 143.550773][ T30] audit: type=1800 audit(1763451149.950:2): pid=7924 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.615" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=712 res=0 errno=0 [ 144.816887][ T7928] syz.3.616: vmalloc error: size 16777216, failed to allocated page array size 32768, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 144.839769][ T7928] CPU: 0 UID: 0 PID: 7928 Comm: syz.3.616 Not tainted syzkaller #0 PREEMPT(full) [ 144.839798][ T7928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 144.839818][ T7928] Call Trace: [ 144.839826][ T7928] [ 144.839836][ T7928] dump_stack_lvl+0x189/0x250 [ 144.839883][ T7928] ? __pfx_dump_stack_lvl+0x10/0x10 [ 144.839912][ T7928] ? __pfx__printk+0x10/0x10 [ 144.839934][ T7928] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 144.839964][ T7928] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 144.839995][ T7928] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 144.840028][ T7928] warn_alloc+0x214/0x310 [ 144.840067][ T7928] ? __pfx_warn_alloc+0x10/0x10 [ 144.840110][ T7928] ? __get_vm_area_node+0x28f/0x300 [ 144.840140][ T7928] ? xp_create_and_assign_umem+0x197/0xd10 [ 144.840167][ T7928] __vmalloc_node_range_noprof+0x690/0x12d0 [ 144.840237][ T7928] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 144.840267][ T7928] ? xp_create_and_assign_umem+0x197/0xd10 [ 144.840293][ T7928] ? rcu_is_watching+0x15/0xb0 [ 144.840326][ T7928] ? xp_create_and_assign_umem+0x197/0xd10 [ 144.840348][ T7928] __kvmalloc_node_noprof+0x674/0x910 [ 144.840382][ T7928] ? xp_create_and_assign_umem+0x197/0xd10 [ 144.840404][ T7928] ? xp_create_and_assign_umem+0xa9/0xd10 [ 144.840435][ T7928] xp_create_and_assign_umem+0x197/0xd10 [ 144.840469][ T7928] ? dev_get_by_index+0x22/0x2e0 [ 144.840495][ T7928] ? dev_get_by_index+0x22/0x2e0 [ 144.840530][ T7928] xsk_bind+0x42d/0xf90 [ 144.840557][ T7928] ? apparmor_socket_bind+0xff/0x1e0 [ 144.840596][ T7928] __sys_bind+0x2c6/0x3e0 [ 144.840631][ T7928] ? __pfx___sys_bind+0x10/0x10 [ 144.840677][ T7928] ? rcu_is_watching+0x15/0xb0 [ 144.840711][ T7928] __x64_sys_bind+0x7a/0x90 [ 144.840744][ T7928] do_syscall_64+0xfa/0xfa0 [ 144.840763][ T7928] ? lockdep_hardirqs_on+0x9c/0x150 [ 144.840784][ T7928] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.840804][ T7928] ? clear_bhb_loop+0x60/0xb0 [ 144.840829][ T7928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.840849][ T7928] RIP: 0033:0x7f2e2358f6c9 [ 144.840877][ T7928] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 144.840894][ T7928] RSP: 002b:00007f2e24354038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 144.840916][ T7928] RAX: ffffffffffffffda RBX: 00007f2e237e6270 RCX: 00007f2e2358f6c9 [ 144.840932][ T7928] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 144.840944][ T7928] RBP: 00007f2e23611f91 R08: 0000000000000000 R09: 0000000000000000 [ 144.840956][ T7928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.840968][ T7928] R13: 00007f2e237e6308 R14: 00007f2e237e6270 R15: 00007ffe6692b888 [ 144.841006][ T7928] [ 144.841018][ T7928] Mem-Info: [ 145.148928][ T7928] active_anon:6674 inactive_anon:0 isolated_anon:0 [ 145.148928][ T7928] active_file:3141 inactive_file:39897 isolated_file:0 [ 145.148928][ T7928] unevictable:768 dirty:289 writeback:0 [ 145.148928][ T7928] slab_reclaimable:10822 slab_unreclaimable:114146 [ 145.148928][ T7928] mapped:32595 shmem:1379 pagetables:1194 [ 145.148928][ T7928] sec_pagetables:0 bounce:0 [ 145.148928][ T7928] kernel_misc_reclaimable:0 [ 145.148928][ T7928] free:1304183 free_pcp:17753 free_cma:0 [ 145.207378][ T7928] Node 0 active_anon:26696kB inactive_anon:0kB active_file:12564kB inactive_file:159384kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:130380kB dirty:1156kB writeback:0kB shmem:3980kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12852kB pagetables:4604kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 145.245249][ T7928] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 145.277238][ T7928] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 145.311910][ T7928] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 145.321600][ T7928] Node 0 DMA32 free:1309272kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:26696kB inactive_anon:0kB active_file:12564kB inactive_file:159384kB unevictable:1536kB writepending:1156kB zspages:0kB present:3129332kB managed:2565108kB mlocked:0kB bounce:0kB free_pcp:51608kB local_pcp:29736kB free_cma:0kB [ 145.358906][ T7928] lowmem_reserve[]: 0 0 0 0 0 [ 145.367426][ T7928] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 145.399450][ T7928] lowmem_reserve[]: 0 0 0 0 0 [ 145.404518][ T7928] Node 1 Normal free:3892100kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:19584kB local_pcp:12320kB free_cma:0kB [ 145.457374][ T7928] lowmem_reserve[]: 0 0 0 0 0 [ 145.462256][ T7928] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 145.478450][ T7928] Node 0 DMA32: 443*4kB (UM) 244*8kB (UME) 173*16kB (UME) 51*32kB (UM) 29*64kB (UME) 27*128kB (UM) 20*256kB (UME) 7*512kB (UME) 3*1024kB (UE) 7*2048kB (UME) 310*4096kB (M) = 1309308kB [ 145.499263][ T7928] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 145.511480][ T7928] Node 1 Normal: 165*4kB (UE) 64*8kB (UME) 51*16kB (UME) 64*32kB (UME) 19*64kB (UME) 6*128kB (UME) 6*256kB (ME) 5*512kB (UME) 3*1024kB (UME) 0*2048kB 947*4096kB (UM) = 3892100kB [ 145.529635][ T7928] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 145.540031][ T7928] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 145.551335][ T7928] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 145.561662][ T7928] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 145.573071][ T7928] 44413 total pagecache pages [ 145.579920][ T7928] 0 pages in swap cache [ 145.582502][ T7968] netlink: 84 bytes leftover after parsing attributes in process `syz.0.629'. [ 145.584136][ T7928] Free swap = 124996kB [ 145.584175][ T7928] Total swap = 124996kB [ 145.584188][ T7928] 2097051 pages RAM [ 145.606682][ T7928] 0 pages HighMem/MovableOnly [ 145.611398][ T7928] 424132 pages reserved [ 145.615777][ T7928] 0 pages cma reserved [ 145.678028][ T7959] netlink: 32 bytes leftover after parsing attributes in process `syz.1.625'. [ 145.687113][ T7959] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 146.647861][ T7989] bridge0: entered promiscuous mode [ 146.657374][ T7989] macvlan2: entered allmulticast mode [ 146.663100][ T7989] bridge0: entered allmulticast mode [ 146.681203][ T7989] bridge0: port 3(macvlan2) entered blocking state [ 146.688212][ T7989] bridge0: port 3(macvlan2) entered disabled state [ 146.700258][ T7989] bridge0: left allmulticast mode [ 146.705610][ T7989] bridge0: left promiscuous mode [ 147.219246][ T8011] bridge0: entered promiscuous mode [ 147.224738][ T8011] macvlan2: entered allmulticast mode [ 147.230759][ T8011] bridge0: entered allmulticast mode [ 147.238896][ T8011] bridge0: port 3(macvlan2) entered blocking state [ 147.249771][ T8011] bridge0: port 3(macvlan2) entered disabled state [ 147.261059][ T8011] bridge0: left allmulticast mode [ 147.266490][ T8011] bridge0: left promiscuous mode [ 147.600456][ T8023] __nla_validate_parse: 7 callbacks suppressed [ 147.600474][ T8023] netlink: 84 bytes leftover after parsing attributes in process `syz.1.647'. [ 147.698384][ T8027] netlink: 28 bytes leftover after parsing attributes in process `syz.2.650'. [ 147.929579][ T8032] netlink: 28 bytes leftover after parsing attributes in process `syz.4.652'. [ 148.233599][ T8045] xt_TCPMSS: Only works on TCP SYN packets [ 148.414233][ T8051] netlink: 8 bytes leftover after parsing attributes in process `syz.2.660'. [ 148.465672][ T8055] netlink: 28 bytes leftover after parsing attributes in process `syz.4.661'. [ 148.504576][ T8055] netlink: 84 bytes leftover after parsing attributes in process `syz.4.661'. [ 148.805996][ T8064] syzkaller1: entered promiscuous mode [ 148.815878][ T8064] syzkaller1: entered allmulticast mode [ 148.898754][ T8071] af_packet: tpacket_rcv: packet too big, clamped from 3971 to 3942. macoff=106 [ 149.269202][ T8086] netlink: 84 bytes leftover after parsing attributes in process `syz.1.672'. [ 149.429338][ T8092] Driver unsupported XDP return value 0 on prog (id 228) dev N/A, expect packet loss! [ 149.479048][ T8090] netlink: 64 bytes leftover after parsing attributes in process `syz.4.677'. [ 149.489929][ T8090] block nbd0: not configured, cannot reconfigure [ 149.501563][ T8095] netlink: 64 bytes leftover after parsing attributes in process `syz.4.677'. [ 149.537347][ T8095] block nbd0: not configured, cannot reconfigure [ 149.607275][ T8105] netlink: 8 bytes leftover after parsing attributes in process `syz.3.679'. [ 151.597644][ T8161] netlink: 'syz.4.696': attribute type 1 has an invalid length. [ 151.717419][ T8161] 8021q: adding VLAN 0 to HW filter on device bond6 [ 151.796817][ T8168] netlink: 'syz.2.698': attribute type 5 has an invalid length. [ 153.973712][ T8247] __nla_validate_parse: 7 callbacks suppressed [ 153.973733][ T8247] netlink: 12 bytes leftover after parsing attributes in process `syz.4.706'. [ 154.032742][ T8249] netlink: 84 bytes leftover after parsing attributes in process `syz.4.706'. [ 154.201952][ T8254] netlink: 4 bytes leftover after parsing attributes in process `syz.0.708'. [ 154.207552][ T8252] netlink: 4 bytes leftover after parsing attributes in process `syz.2.709'. [ 154.249391][ T8254] bridge0: entered promiscuous mode [ 154.254814][ T8254] macvlan2: entered allmulticast mode [ 154.260566][ T8254] bridge0: entered allmulticast mode [ 154.271370][ T8254] bridge0: port 3(macvlan2) entered blocking state [ 154.280467][ T8254] bridge0: port 3(macvlan2) entered disabled state [ 154.294136][ T8254] bridge0: left allmulticast mode [ 154.300069][ T8254] bridge0: left promiscuous mode [ 154.336022][ T8252] bridge0: entered promiscuous mode [ 154.341441][ T8252] macvlan2: entered allmulticast mode [ 154.347292][ T8252] bridge0: entered allmulticast mode [ 154.354572][ T8252] bridge0: port 3(macvlan2) entered blocking state [ 154.362704][ T8252] bridge0: port 3(macvlan2) entered disabled state [ 154.373642][ T8252] bridge0: left allmulticast mode [ 154.383151][ T8252] bridge0: left promiscuous mode [ 154.749369][ T8259] netlink: 84 bytes leftover after parsing attributes in process `syz.2.710'. [ 154.872738][ T8265] netlink: 'syz.4.712': attribute type 1 has an invalid length. [ 155.027298][ T8272] netlink: 84 bytes leftover after parsing attributes in process `syz.4.712'. [ 155.142244][ T8265] 8021q: adding VLAN 0 to HW filter on device bond7 [ 156.503579][ T8273] lo: entered promiscuous mode [ 156.824848][ T8336] netlink: 'syz.3.730': attribute type 1 has an invalid length. [ 156.843878][ T8337] netlink: 128 bytes leftover after parsing attributes in process `syz.4.729'. [ 156.854158][ T8337] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 156.899373][ T8341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.731'. [ 156.913238][ T8336] 8021q: adding VLAN 0 to HW filter on device bond2 [ 156.932498][ T8336] netlink: 84 bytes leftover after parsing attributes in process `syz.3.730'. [ 157.255114][ T8349] netlink: 28 bytes leftover after parsing attributes in process `syz.2.732'. [ 157.292373][ T8349] dummy0: entered promiscuous mode [ 157.307076][ T8349] bridge0: entered promiscuous mode [ 158.711686][ T8399] netlink: 'syz.3.748': attribute type 1 has an invalid length. [ 159.006301][ T8408] __nla_validate_parse: 3 callbacks suppressed [ 159.006319][ T8408] netlink: 4 bytes leftover after parsing attributes in process `syz.2.751'. [ 159.050417][ T8399] 8021q: adding VLAN 0 to HW filter on device bond3 [ 159.304279][ T8370] lo: entered promiscuous mode [ 159.960325][ T8430] netlink: 44 bytes leftover after parsing attributes in process `syz.4.758'. [ 160.284509][ T8444] netlink: 12 bytes leftover after parsing attributes in process `syz.3.761'. [ 160.332025][ T8448] netlink: 84 bytes leftover after parsing attributes in process `syz.3.761'. [ 160.455931][ T8453] netlink: 'syz.0.763': attribute type 1 has an invalid length. [ 160.577583][ T8459] netlink: 84 bytes leftover after parsing attributes in process `syz.0.763'. [ 160.630199][ T8463] netlink: 28 bytes leftover after parsing attributes in process `syz.2.764'. [ 160.648023][ T8453] 8021q: adding VLAN 0 to HW filter on device bond4 [ 161.084660][ T8484] netlink: 24 bytes leftover after parsing attributes in process `syz.2.766'. [ 161.229591][ T8490] netlink: 28 bytes leftover after parsing attributes in process `syz.2.768'. [ 161.254027][ T8488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.767'. [ 161.274264][ T8488] netlink: 4 bytes leftover after parsing attributes in process `syz.3.767'. [ 161.576756][ T5829] Bluetooth: hci4: link tx timeout [ 161.582349][ T5829] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 161.593041][ T52] Bluetooth: hci4: link tx timeout [ 161.601433][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 161.609887][ T52] Bluetooth: hci4: link tx timeout [ 161.615078][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 161.757801][ T8519] bridge0: entered promiscuous mode [ 161.781748][ T8519] macvlan2: entered allmulticast mode [ 161.791799][ T8519] bridge0: entered allmulticast mode [ 161.799556][ T8519] bridge0: port 1(macvlan2) entered blocking state [ 161.806766][ T8519] bridge0: port 1(macvlan2) entered disabled state [ 161.825111][ T8519] bridge0: left allmulticast mode [ 161.830347][ T8519] bridge0: left promiscuous mode [ 161.870023][ T8528] netlink: 'syz.0.780': attribute type 5 has an invalid length. [ 161.879346][ T8530] netlink: 'syz.4.781': attribute type 1 has an invalid length. [ 162.069521][ T8530] 8021q: adding VLAN 0 to HW filter on device bond8 [ 162.136449][ T8535] IPVS: set_ctl: invalid protocol: 4 255.255.255.255:20003 [ 162.430588][ T8543] netlink: 'syz.2.783': attribute type 1 has an invalid length. [ 163.115277][ T8561] syzkaller1: entered promiscuous mode [ 163.140056][ T8561] syzkaller1: entered allmulticast mode [ 163.186737][ T8563] netlink: 'syz.0.791': attribute type 10 has an invalid length. [ 163.303104][ T8561] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.314975][ T8561] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.335432][ T8574] netlink: 'syz.0.795': attribute type 23 has an invalid length. [ 163.585761][ T8587] netlink: 'syz.4.797': attribute type 1 has an invalid length. [ 163.657841][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 163.948683][ T8605] netlink: 'syz.0.813': attribute type 13 has an invalid length. [ 163.976598][ T8605] netlink: 'syz.0.813': attribute type 17 has an invalid length. [ 163.984435][ T8605] lo: left promiscuous mode [ 164.118490][ T8605] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 164.213481][ T8605] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 164.322472][ T8617] __nla_validate_parse: 10 callbacks suppressed [ 164.322490][ T8617] netlink: 28 bytes leftover after parsing attributes in process `syz.3.808'. [ 164.355274][ T8614] 8021q: adding VLAN 0 to HW filter on device bond9 [ 164.409704][ T8614] netlink: 84 bytes leftover after parsing attributes in process `syz.1.807'. [ 164.645917][ T8624] netlink: 12 bytes leftover after parsing attributes in process `syz.3.812'. [ 164.913044][ T8645] netlink: 12 bytes leftover after parsing attributes in process `syz.2.816'. [ 165.022847][ C1] vcan0: j1939_xtp_rx_rts: failed to create TP BAM session [ 165.264924][ T8666] netlink: 'syz.2.821': attribute type 1 has an invalid length. [ 165.273416][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802ce76400: rx timeout, send abort [ 165.318148][ T8666] netlink: 84 bytes leftover after parsing attributes in process `syz.2.821'. [ 165.321794][ T8664] netlink: 'syz.1.823': attribute type 1 has an invalid length. [ 165.389351][ T8664] 8021q: adding VLAN 0 to HW filter on device bond10 [ 165.774407][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802ce76400: abort rx timeout. Force session deactivation [ 166.155942][ T8688] bond9: entered promiscuous mode [ 166.174891][ T8688] bond9: entered allmulticast mode [ 166.198384][ T8688] 8021q: adding VLAN 0 to HW filter on device bond9 [ 166.422377][ T8695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 166.457982][ T8695] bond0: (slave rose0): Enslaving as an active interface with an up link [ 167.440971][ T8752] netlink: 'syz.1.845': attribute type 1 has an invalid length. [ 167.497876][ T8752] netlink: 84 bytes leftover after parsing attributes in process `syz.1.845'. [ 167.527567][ T8754] bridge: RTM_NEWNEIGH with invalid state 0x10 [ 167.620406][ T8757] netlink: 8 bytes leftover after parsing attributes in process `syz.0.848'. [ 168.597166][ T8785] netlink: 36 bytes leftover after parsing attributes in process `syz.1.853'. [ 170.575222][ T8757] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 170.596953][ T8757] macvtap1: entered promiscuous mode [ 171.073123][ T8822] netlink: 'syz.0.862': attribute type 1 has an invalid length. [ 171.145913][ T8829] netlink: 'syz.4.861': attribute type 1 has an invalid length. [ 171.158371][ T8831] netlink: 44 bytes leftover after parsing attributes in process `syz.0.862'. [ 171.269867][ T8838] netlink: 84 bytes leftover after parsing attributes in process `syz.4.861'. [ 171.586037][ T8849] netlink: 40 bytes leftover after parsing attributes in process `syz.0.868'. [ 171.595423][ T8849] netlink: 40 bytes leftover after parsing attributes in process `syz.0.868'. [ 172.237164][ T8874] netlink: 'syz.1.875': attribute type 10 has an invalid length. [ 172.319077][ T8874] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.351144][ T8874] bond0: (slave team0): Enslaving as an active interface with an up link [ 172.780149][ T8892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.880'. [ 172.895188][ T8900] netlink: 'syz.1.882': attribute type 1 has an invalid length. [ 172.971428][ T8900] netlink: 84 bytes leftover after parsing attributes in process `syz.1.882'. [ 173.164188][ T8913] netlink: 'syz.4.886': attribute type 1 has an invalid length. [ 173.236993][ T8913] 8021q: adding VLAN 0 to HW filter on device bond10 [ 173.244526][ T8915] netlink: 76 bytes leftover after parsing attributes in process `syz.0.887'. [ 173.269980][ T8913] netlink: 84 bytes leftover after parsing attributes in process `syz.4.886'. [ 173.553368][ T8933] netlink: 4 bytes leftover after parsing attributes in process `syz.0.893'. [ 173.753612][ T8942] netlink: 'syz.1.896': attribute type 10 has an invalid length. [ 173.767722][ T8942] netlink: 40 bytes leftover after parsing attributes in process `syz.1.896'. [ 173.788870][ T8942] team0: Port device geneve0 added [ 174.507844][ T8972] netlink: 'syz.2.905': attribute type 10 has an invalid length. [ 174.559203][ T8972] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.611328][ T8972] bond0: (slave team0): Enslaving as an active interface with an up link [ 174.680005][ T30] audit: type=1800 audit(1763451181.070:3): pid=8966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.900" name="memory.events" dev="tmpfs" ino=881 res=0 errno=0 [ 174.733037][ T8979] netlink: 'syz.0.906': attribute type 1 has an invalid length. [ 175.292285][ T8993] netlink: 'syz.4.910': attribute type 1 has an invalid length. [ 175.579757][ T8993] 8021q: adding VLAN 0 to HW filter on device bond11 [ 175.831677][ T9003] syzkaller0: entered promiscuous mode [ 175.856025][ T9003] syzkaller0: entered allmulticast mode [ 176.305094][ T9023] netlink: 'syz.4.917': attribute type 4 has an invalid length. [ 176.347699][ T9023] netlink: 'syz.4.917': attribute type 142 has an invalid length. [ 176.421308][ T9019] __nla_validate_parse: 4 callbacks suppressed [ 176.421329][ T9019] netlink: 28 bytes leftover after parsing attributes in process `syz.3.916'. [ 176.455031][ T9023] netlink: 'syz.4.917': attribute type 4 has an invalid length. [ 176.515395][ T9019] netlink: 28 bytes leftover after parsing attributes in process `syz.3.916'. [ 176.661097][ T9036] netlink: 16 bytes leftover after parsing attributes in process `syz.2.921'. [ 176.789031][ T9045] netlink: 'syz.0.922': attribute type 1 has an invalid length. [ 176.907539][ T9046] bond11: entered promiscuous mode [ 176.913472][ T9046] 8021q: adding VLAN 0 to HW filter on device bond11 [ 176.934618][ T9054] netlink: 84 bytes leftover after parsing attributes in process `syz.0.922'. [ 176.955077][ T9046] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 176.962708][ T9046] IPv6: NLM_F_CREATE should be set when creating new route [ 176.970077][ T9046] IPv6: NLM_F_CREATE should be set when creating new route [ 177.007114][ T9046] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 177.026249][ T9045] 8021q: adding VLAN 0 to HW filter on device bond6 [ 177.074410][ T9051] 8021q: adding VLAN 0 to HW filter on device bond11 [ 177.082794][ T9051] bond11: (slave wireguard0): The slave device specified does not support setting the MAC address [ 177.094772][ T9051] bond11: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 177.111039][ T9051] bond11: (slave wireguard0): making interface the new active one [ 177.120040][ T9051] wireguard0: entered promiscuous mode [ 177.127753][ T9051] bond11: (slave wireguard0): Enslaving as an active interface with an up link [ 177.162856][ T9046] bond11: (slave wireguard1): The slave device specified does not support setting the MAC address [ 177.179391][ T9046] bond11: (slave wireguard1): Enslaving as a backup interface with an up link [ 177.744937][ T9065] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 177.967798][ T9077] validate_nla: 2 callbacks suppressed [ 177.967817][ T9077] netlink: 'syz.1.928': attribute type 1 has an invalid length. [ 178.079689][ T9079] netlink: 84 bytes leftover after parsing attributes in process `syz.1.928'. [ 178.337850][ T9076] bond9: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 178.357749][ T9076] bond9 (unregistering): Released all slaves [ 178.484027][ T9077] 8021q: adding VLAN 0 to HW filter on device bond12 [ 178.745447][ T9091] netlink: 44 bytes leftover after parsing attributes in process `syz.0.932'. [ 178.938527][ T9096] ip6gretap2: entered promiscuous mode [ 179.075718][ T9110] netlink: 'syz.3.935': attribute type 1 has an invalid length. [ 179.168735][ T9113] netlink: 28 bytes leftover after parsing attributes in process `syz.2.938'. [ 179.203184][ T9110] 8021q: adding VLAN 0 to HW filter on device bond4 [ 179.268723][ T9121] netlink: 84 bytes leftover after parsing attributes in process `syz.3.935'. [ 179.458147][ T9125] netlink: 4 bytes leftover after parsing attributes in process `syz.2.941'. [ 179.511298][ T9128] netlink: 4 bytes leftover after parsing attributes in process `syz.2.941'. [ 179.601123][ T9128] veth5: entered promiscuous mode [ 179.731679][ T9130] dummy0: entered promiscuous mode [ 179.766967][ T9130] bridge0: entered promiscuous mode [ 179.809059][ T9130] debugfs: 'hsr1' already exists in 'hsr' [ 179.810189][ T9142] netlink: 'syz.0.946': attribute type 1 has an invalid length. [ 179.814950][ T9130] Cannot create hsr debugfs directory [ 179.815110][ T9130] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 179.848017][ T9130] hsr1: Slave B (bridge0) is not up; please bring it up to get a fully working HSR network [ 180.076307][ T9142] 8021q: adding VLAN 0 to HW filter on device bond7 [ 180.178833][ T9159] xt_CT: You must specify a L4 protocol and not use inversions on it [ 180.806729][ T9177] syzkaller0: entered promiscuous mode [ 180.812321][ T9177] syzkaller0: entered allmulticast mode [ 181.218426][ T9184] bridge0: entered promiscuous mode [ 181.232347][ T9184] macvlan2: entered allmulticast mode [ 181.238092][ T9184] bridge0: entered allmulticast mode [ 181.280201][ T9184] bridge0: port 3(macvlan2) entered blocking state [ 181.313611][ T9184] bridge0: port 3(macvlan2) entered disabled state [ 181.349415][ T9184] bridge0: left allmulticast mode [ 181.359911][ T9184] bridge0: left promiscuous mode [ 181.452786][ T9187] netlink: 'syz.3.958': attribute type 1 has an invalid length. [ 181.563364][ T9191] __nla_validate_parse: 6 callbacks suppressed [ 181.563384][ T9191] netlink: 84 bytes leftover after parsing attributes in process `syz.3.958'. [ 181.810855][ T9199] netlink: 32 bytes leftover after parsing attributes in process `syz.0.962'. [ 182.709456][ T9187] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 182.746837][ T9199] tipc: Enabled bearer , priority 0 [ 182.776716][ T9200] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 182.784178][ T9200] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 183.014296][ T9215] netlink: 'syz.4.964': attribute type 1 has an invalid length. [ 183.154262][ T9219] netlink: 12 bytes leftover after parsing attributes in process `syz.0.965'. [ 183.177626][ T9221] netlink: 84 bytes leftover after parsing attributes in process `syz.4.964'. [ 183.251284][ T9228] netlink: 12 bytes leftover after parsing attributes in process `syz.3.966'. [ 183.272711][ T9227] netlink: 28 bytes leftover after parsing attributes in process `syz.1.967'. [ 183.409589][ T9215] 8021q: adding VLAN 0 to HW filter on device bond12 [ 183.436349][ T9222] netlink: 'syz.3.966': attribute type 3 has an invalid length. [ 183.529713][ T9240] netlink: 'syz.0.969': attribute type 13 has an invalid length. [ 183.555429][ T9240] netlink: 'syz.0.969': attribute type 17 has an invalid length. [ 183.645828][ T9240] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 184.067211][ T9262] netlink: 'syz.3.973': attribute type 1 has an invalid length. [ 184.181315][ T9272] netlink: 84 bytes leftover after parsing attributes in process `syz.3.973'. [ 184.217262][ T9262] 8021q: adding VLAN 0 to HW filter on device bond5 [ 184.298521][ T9277] netlink: 100 bytes leftover after parsing attributes in process `syz.1.976'. [ 184.321722][ T9279] netlink: 12 bytes leftover after parsing attributes in process `syz.4.974'. [ 184.400735][ T9271] netlink: 28 bytes leftover after parsing attributes in process `syz.0.978'. [ 184.417379][ T9271] team0: entered promiscuous mode [ 184.434463][ T9271] team_slave_0: entered promiscuous mode [ 184.446378][ T9271] team_slave_1: entered promiscuous mode [ 184.487804][ T9271] bridge0: entered promiscuous mode [ 184.494020][ T9271] debugfs: 'hsr1' already exists in 'hsr' [ 184.500413][ T9271] Cannot create hsr debugfs directory [ 185.694262][ T9268] syz.2.977 (9268) used greatest stack depth: 17656 bytes left [ 186.042914][ T9306] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.050755][ T9306] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.167678][ T9306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.191510][ T9306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.446406][ T8230] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.493352][ T8230] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.595165][ T8230] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.623531][ T9334] netlink: 'syz.2.990': attribute type 1 has an invalid length. [ 186.668841][ T8230] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.727024][ T9334] 8021q: adding VLAN 0 to HW filter on device bond9 [ 186.743153][ T9338] __nla_validate_parse: 5 callbacks suppressed [ 186.743172][ T9338] netlink: 84 bytes leftover after parsing attributes in process `syz.2.990'. [ 187.423133][ T9357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.997'. [ 187.951390][ T9373] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1001'. [ 188.490196][ T9390] FAULT_INJECTION: forcing a failure. [ 188.490196][ T9390] name failslab, interval 1, probability 0, space 0, times 1 [ 188.536032][ T9390] CPU: 0 UID: 0 PID: 9390 Comm: syz.2.1009 Not tainted syzkaller #0 PREEMPT(full) [ 188.536060][ T9390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 188.536072][ T9390] Call Trace: [ 188.536080][ T9390] [ 188.536089][ T9390] dump_stack_lvl+0x189/0x250 [ 188.536135][ T9390] ? __pfx____ratelimit+0x10/0x10 [ 188.536167][ T9390] ? __pfx_dump_stack_lvl+0x10/0x10 [ 188.536196][ T9390] ? __pfx__printk+0x10/0x10 [ 188.536223][ T9390] ? __pfx___might_resched+0x10/0x10 [ 188.536251][ T9390] should_fail_ex+0x414/0x560 [ 188.536286][ T9390] should_failslab+0xa8/0x100 [ 188.536317][ T9390] kmem_cache_alloc_node_noprof+0x77/0x710 [ 188.536346][ T9390] ? call_fib_notifiers+0x4a/0x60 [ 188.536368][ T9390] ? __alloc_skb+0x112/0x2d0 [ 188.536394][ T9390] __alloc_skb+0x112/0x2d0 [ 188.536417][ T9390] ? __pfx_fib4_rule_nlmsg_payload+0x10/0x10 [ 188.536446][ T9390] notify_rule_change+0xb1/0x210 [ 188.536476][ T9390] fib_newrule+0xd3d/0xf20 [ 188.536509][ T9390] ? __pfx_fib_newrule+0x10/0x10 [ 188.536530][ T9390] ? is_bpf_text_address+0x26/0x2b0 [ 188.536593][ T9390] ? __pfx_fib_nl_newrule+0x10/0x10 [ 188.536618][ T9390] rtnetlink_rcv_msg+0x7cf/0xb70 [ 188.536637][ T9390] ? __lock_acquire+0xab9/0xd20 [ 188.536659][ T9390] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 188.536679][ T9390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 188.536717][ T9390] netlink_rcv_skb+0x208/0x470 [ 188.536737][ T9390] ? __lock_acquire+0xab9/0xd20 [ 188.536757][ T9390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 188.536779][ T9390] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 188.536813][ T9390] ? netlink_deliver_tap+0x2e/0x1b0 [ 188.536843][ T9390] netlink_unicast+0x82f/0x9e0 [ 188.536885][ T9390] ? __pfx_netlink_unicast+0x10/0x10 [ 188.536918][ T9390] ? netlink_sendmsg+0x642/0xb30 [ 188.536938][ T9390] ? skb_put+0x11b/0x210 [ 188.536962][ T9390] netlink_sendmsg+0x805/0xb30 [ 188.536994][ T9390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 188.537020][ T9390] ? aa_sock_msg_perm+0xf1/0x1d0 [ 188.537051][ T9390] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 188.537071][ T9390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 188.537094][ T9390] __sock_sendmsg+0x21c/0x270 [ 188.537127][ T9390] ____sys_sendmsg+0x505/0x830 [ 188.537156][ T9390] ? __pfx_____sys_sendmsg+0x10/0x10 [ 188.537190][ T9390] ? import_iovec+0x74/0xa0 [ 188.537220][ T9390] ___sys_sendmsg+0x21f/0x2a0 [ 188.537247][ T9390] ? __pfx____sys_sendmsg+0x10/0x10 [ 188.537315][ T9390] ? __fget_files+0x2a/0x420 [ 188.537336][ T9390] ? __fget_files+0x3a0/0x420 [ 188.537367][ T9390] __x64_sys_sendmsg+0x19b/0x260 [ 188.537395][ T9390] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 188.537430][ T9390] ? __pfx_ksys_write+0x10/0x10 [ 188.537464][ T9390] ? do_syscall_64+0xbe/0xfa0 [ 188.537489][ T9390] do_syscall_64+0xfa/0xfa0 [ 188.537507][ T9390] ? lockdep_hardirqs_on+0x9c/0x150 [ 188.537528][ T9390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.537549][ T9390] ? clear_bhb_loop+0x60/0xb0 [ 188.537574][ T9390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.537594][ T9390] RIP: 0033:0x7ff9a6b8f6c9 [ 188.537623][ T9390] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 188.537640][ T9390] RSP: 002b:00007ff9a7ac3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 188.537670][ T9390] RAX: ffffffffffffffda RBX: 00007ff9a6de5fa0 RCX: 00007ff9a6b8f6c9 [ 188.537685][ T9390] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 188.537698][ T9390] RBP: 00007ff9a7ac3090 R08: 0000000000000000 R09: 0000000000000000 [ 188.537710][ T9390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 188.537721][ T9390] R13: 00007ff9a6de6038 R14: 00007ff9a6de5fa0 R15: 00007fffbc2f5cd8 [ 188.537755][ T9390] [ 188.579843][ T9396] netlink: 'syz.3.1008': attribute type 1 has an invalid length. [ 188.796189][ T9399] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1008'. [ 188.826541][ T9405] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1012'. [ 188.993878][ T9396] 8021q: adding VLAN 0 to HW filter on device bond6 [ 189.049110][ T9404] bridge_slave_0: left allmulticast mode [ 189.055055][ T9404] bridge_slave_0: left promiscuous mode [ 189.061423][ T9404] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.076642][ T9404] bridge_slave_1: left allmulticast mode [ 189.086344][ T9404] bridge_slave_1: left promiscuous mode [ 189.094284][ T9404] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.358406][ T9404] bond0: (slave bond_slave_0): Releasing backup interface [ 189.366404][ T9410] netlink: 23 bytes leftover after parsing attributes in process `syz.4.1013'. [ 189.379737][ T9404] bond_slave_0: left promiscuous mode [ 189.393181][ T9404] bond0: (slave bond_slave_1): Releasing backup interface [ 189.407997][ T9404] bond_slave_1: left promiscuous mode [ 189.429777][ T9404] team0: Port device team_slave_0 removed [ 189.446855][ T9404] team0: Port device team_slave_1 removed [ 189.453722][ T9404] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 189.464208][ T9404] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 189.477122][ T9404] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 189.484792][ T9404] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 189.496300][ T9404] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 189.533788][ T9414] syzkaller0: entered promiscuous mode [ 189.545867][ T9414] syzkaller0: entered allmulticast mode [ 189.579677][ T9425] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1014'. [ 189.880763][ T9445] netlink: 204 bytes leftover after parsing attributes in process `syz.3.1019'. [ 189.924568][ T9445] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 190.371671][ T9459] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1025'. [ 190.402135][ T9465] netlink: 'syz.4.1027': attribute type 1 has an invalid length. [ 190.432607][ T9459] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1025'. [ 190.543856][ T9465] 8021q: adding VLAN 0 to HW filter on device bond13 [ 191.291433][ T9497] tipc: Enabling of bearer rejected, already enabled [ 191.524586][ T9507] FAULT_INJECTION: forcing a failure. [ 191.524586][ T9507] name failslab, interval 1, probability 0, space 0, times 0 [ 191.557003][ T9507] CPU: 0 UID: 0 PID: 9507 Comm: syz.4.1041 Not tainted syzkaller #0 PREEMPT(full) [ 191.557031][ T9507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 191.557043][ T9507] Call Trace: [ 191.557051][ T9507] [ 191.557060][ T9507] dump_stack_lvl+0x189/0x250 [ 191.557093][ T9507] ? __pfx____ratelimit+0x10/0x10 [ 191.557123][ T9507] ? __pfx_dump_stack_lvl+0x10/0x10 [ 191.557151][ T9507] ? __pfx__printk+0x10/0x10 [ 191.557178][ T9507] ? __pfx___might_resched+0x10/0x10 [ 191.557199][ T9507] ? fs_reclaim_acquire+0x7d/0x100 [ 191.557225][ T9507] should_fail_ex+0x414/0x560 [ 191.557262][ T9507] should_failslab+0xa8/0x100 [ 191.557292][ T9507] kmem_cache_alloc_noprof+0x74/0x6e0 [ 191.557321][ T9507] ? fib_insert_alias+0x13b/0x1210 [ 191.557355][ T9507] fib_insert_alias+0x13b/0x1210 [ 191.557387][ T9507] ? lockdep_rtnl_is_held+0x26/0x40 [ 191.557413][ T9507] ? fib_find_node+0x28d/0x2f0 [ 191.557445][ T9507] fib_trie_unmerge+0x310/0xcd0 [ 191.557486][ T9507] fib_unmerge+0xc5/0x360 [ 191.557513][ T9507] fib4_rule_configure+0x2e2/0xa50 [ 191.557546][ T9507] fib_newrule+0x512/0xf20 [ 191.557582][ T9507] ? __pfx_fib_newrule+0x10/0x10 [ 191.557620][ T9507] ? __dev_queue_xmit+0x1bfb/0x3740 [ 191.557690][ T9507] ? __pfx_fib_nl_newrule+0x10/0x10 [ 191.557715][ T9507] rtnetlink_rcv_msg+0x7cf/0xb70 [ 191.557740][ T9507] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 191.557759][ T9507] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 191.557777][ T9507] ? ref_tracker_free+0x63a/0x7d0 [ 191.557797][ T9507] ? __asan_memcpy+0x40/0x70 [ 191.557825][ T9507] ? __pfx_ref_tracker_free+0x10/0x10 [ 191.557858][ T9507] netlink_rcv_skb+0x208/0x470 [ 191.557882][ T9507] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 191.557904][ T9507] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 191.557940][ T9507] ? netlink_deliver_tap+0x2e/0x1b0 [ 191.557972][ T9507] netlink_unicast+0x82f/0x9e0 [ 191.558014][ T9507] ? __pfx_netlink_unicast+0x10/0x10 [ 191.558049][ T9507] ? netlink_sendmsg+0x642/0xb30 [ 191.558070][ T9507] ? skb_put+0x11b/0x210 [ 191.558096][ T9507] netlink_sendmsg+0x805/0xb30 [ 191.558130][ T9507] ? __pfx_netlink_sendmsg+0x10/0x10 [ 191.558158][ T9507] ? aa_sock_msg_perm+0xf1/0x1d0 [ 191.558191][ T9507] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 191.558212][ T9507] ? __pfx_netlink_sendmsg+0x10/0x10 [ 191.558236][ T9507] __sock_sendmsg+0x21c/0x270 [ 191.558276][ T9507] ____sys_sendmsg+0x505/0x830 [ 191.558307][ T9507] ? __pfx_____sys_sendmsg+0x10/0x10 [ 191.558342][ T9507] ? import_iovec+0x74/0xa0 [ 191.558373][ T9507] ___sys_sendmsg+0x21f/0x2a0 [ 191.558401][ T9507] ? __pfx____sys_sendmsg+0x10/0x10 [ 191.558466][ T9507] ? __fget_files+0x2a/0x420 [ 191.558486][ T9507] ? __fget_files+0x3a0/0x420 [ 191.558519][ T9507] __x64_sys_sendmsg+0x19b/0x260 [ 191.558546][ T9507] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 191.558591][ T9507] ? do_syscall_64+0xbe/0xfa0 [ 191.558616][ T9507] do_syscall_64+0xfa/0xfa0 [ 191.558634][ T9507] ? lockdep_hardirqs_on+0x9c/0x150 [ 191.558654][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.558675][ T9507] ? clear_bhb_loop+0x60/0xb0 [ 191.558700][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.558720][ T9507] RIP: 0033:0x7fbf7198f6c9 [ 191.558739][ T9507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 191.558767][ T9507] RSP: 002b:00007fbf72767038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 191.558789][ T9507] RAX: ffffffffffffffda RBX: 00007fbf71be5fa0 RCX: 00007fbf7198f6c9 [ 191.558802][ T9507] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 191.558814][ T9507] RBP: 00007fbf72767090 R08: 0000000000000000 R09: 0000000000000000 [ 191.558825][ T9507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 191.558835][ T9507] R13: 00007fbf71be6038 R14: 00007fbf71be5fa0 R15: 00007ffe03f1d248 [ 191.558869][ T9507] [ 191.961615][ T9509] netlink: 'syz.0.1043': attribute type 1 has an invalid length. [ 191.994838][ T9511] Cannot find add_set index 0 as target [ 192.035952][ T9511] Cannot find add_set index 0 as target [ 192.041735][ T9511] Cannot find add_set index 0 as target [ 192.096629][ T9511] Cannot find add_set index 0 as target [ 192.102398][ T9511] Cannot find add_set index 0 as target [ 192.108329][ T9511] Cannot find add_set index 0 as target [ 192.114150][ T9511] Cannot find add_set index 0 as target [ 192.120078][ T9511] Cannot find add_set index 0 as target [ 192.126068][ T9511] Cannot find add_set index 0 as target [ 192.131895][ T9511] Cannot find add_set index 0 as target [ 192.153945][ T9515] __nla_validate_parse: 6 callbacks suppressed [ 192.153964][ T9515] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1046'. [ 192.156238][ T9519] netlink: 'syz.4.1045': attribute type 64 has an invalid length. [ 192.163260][ T9516] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1043'. [ 192.200709][ T9509] 8021q: adding VLAN 0 to HW filter on device bond8 [ 192.327807][ T9522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1047'. [ 192.638811][ T9537] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1054'. [ 192.664174][ T9539] FAULT_INJECTION: forcing a failure. [ 192.664174][ T9539] name failslab, interval 1, probability 0, space 0, times 0 [ 192.725618][ T9539] CPU: 1 UID: 0 PID: 9539 Comm: syz.4.1055 Not tainted syzkaller #0 PREEMPT(full) [ 192.725646][ T9539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 192.725658][ T9539] Call Trace: [ 192.725666][ T9539] [ 192.725675][ T9539] dump_stack_lvl+0x189/0x250 [ 192.725709][ T9539] ? __pfx____ratelimit+0x10/0x10 [ 192.725740][ T9539] ? __pfx_dump_stack_lvl+0x10/0x10 [ 192.725767][ T9539] ? __pfx__printk+0x10/0x10 [ 192.725794][ T9539] ? __pfx___might_resched+0x10/0x10 [ 192.725816][ T9539] ? fs_reclaim_acquire+0x7d/0x100 [ 192.725841][ T9539] should_fail_ex+0x414/0x560 [ 192.725878][ T9539] should_failslab+0xa8/0x100 [ 192.725901][ T9539] kmem_cache_alloc_noprof+0x74/0x6e0 [ 192.725936][ T9539] ? leaf_walk_rcu+0x2d9/0x720 [ 192.725964][ T9539] ? fib_trie_unmerge+0x272/0xcd0 [ 192.725998][ T9539] fib_trie_unmerge+0x272/0xcd0 [ 192.726039][ T9539] fib_unmerge+0xc5/0x360 [ 192.726066][ T9539] fib4_rule_configure+0x2e2/0xa50 [ 192.726118][ T9539] fib_newrule+0x512/0xf20 [ 192.726154][ T9539] ? __pfx_fib_newrule+0x10/0x10 [ 192.726175][ T9539] ? __dev_queue_xmit+0x1bfb/0x3740 [ 192.726244][ T9539] ? __pfx_fib_nl_newrule+0x10/0x10 [ 192.726269][ T9539] rtnetlink_rcv_msg+0x7cf/0xb70 [ 192.726295][ T9539] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 192.726314][ T9539] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 192.726331][ T9539] ? ref_tracker_free+0x63a/0x7d0 [ 192.726352][ T9539] ? __asan_memcpy+0x40/0x70 [ 192.726379][ T9539] ? __pfx_ref_tracker_free+0x10/0x10 [ 192.726411][ T9539] netlink_rcv_skb+0x208/0x470 [ 192.726435][ T9539] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 192.726458][ T9539] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 192.726493][ T9539] ? netlink_deliver_tap+0x2e/0x1b0 [ 192.726525][ T9539] netlink_unicast+0x82f/0x9e0 [ 192.726567][ T9539] ? __pfx_netlink_unicast+0x10/0x10 [ 192.726602][ T9539] ? netlink_sendmsg+0x642/0xb30 [ 192.726621][ T9539] ? skb_put+0x11b/0x210 [ 192.726647][ T9539] netlink_sendmsg+0x805/0xb30 [ 192.726681][ T9539] ? __pfx_netlink_sendmsg+0x10/0x10 [ 192.726707][ T9539] ? aa_sock_msg_perm+0xf1/0x1d0 [ 192.726740][ T9539] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 192.726760][ T9539] ? __pfx_netlink_sendmsg+0x10/0x10 [ 192.726784][ T9539] __sock_sendmsg+0x21c/0x270 [ 192.726818][ T9539] ____sys_sendmsg+0x505/0x830 [ 192.726848][ T9539] ? __pfx_____sys_sendmsg+0x10/0x10 [ 192.726883][ T9539] ? import_iovec+0x74/0xa0 [ 192.726913][ T9539] ___sys_sendmsg+0x21f/0x2a0 [ 192.726948][ T9539] ? __pfx____sys_sendmsg+0x10/0x10 [ 192.727014][ T9539] ? __fget_files+0x2a/0x420 [ 192.727034][ T9539] ? __fget_files+0x3a0/0x420 [ 192.727066][ T9539] __x64_sys_sendmsg+0x19b/0x260 [ 192.727094][ T9539] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 192.727129][ T9539] ? __pfx_ksys_write+0x10/0x10 [ 192.727163][ T9539] ? do_syscall_64+0xbe/0xfa0 [ 192.727188][ T9539] do_syscall_64+0xfa/0xfa0 [ 192.727207][ T9539] ? lockdep_hardirqs_on+0x9c/0x150 [ 192.727228][ T9539] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.727248][ T9539] ? clear_bhb_loop+0x60/0xb0 [ 192.727273][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.727292][ T9539] RIP: 0033:0x7fbf7198f6c9 [ 192.727310][ T9539] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 192.727326][ T9539] RSP: 002b:00007fbf72767038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 192.727348][ T9539] RAX: ffffffffffffffda RBX: 00007fbf71be5fa0 RCX: 00007fbf7198f6c9 [ 192.727363][ T9539] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 192.727375][ T9539] RBP: 00007fbf72767090 R08: 0000000000000000 R09: 0000000000000000 [ 192.727388][ T9539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 192.727399][ T9539] R13: 00007fbf71be6038 R14: 00007fbf71be5fa0 R15: 00007ffe03f1d248 [ 192.727435][ T9539] [ 193.196849][ T9549] netlink: 'syz.0.1056': attribute type 13 has an invalid length. [ 193.215050][ T9549] netlink: 'syz.0.1056': attribute type 17 has an invalid length. [ 193.310845][ T9549] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 193.316264][ T9553] netlink: 'syz.2.1059': attribute type 1 has an invalid length. [ 193.443947][ T9563] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1059'. [ 193.501051][ T9553] 8021q: adding VLAN 0 to HW filter on device bond10 [ 193.541716][ T9561] netlink: 'syz.1.1061': attribute type 1 has an invalid length. [ 193.611084][ T9570] netlink: 264 bytes leftover after parsing attributes in process `syz.1.1061'. [ 193.692129][ T9561] netlink: 14436 bytes leftover after parsing attributes in process `syz.1.1061'. [ 193.770138][ T9570] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1061'. [ 194.221019][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.227921][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.360865][ T9587] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1066'. [ 194.383337][ T9580] syzkaller0: entered promiscuous mode [ 194.391445][ T9580] syzkaller0: entered allmulticast mode [ 195.200636][ T9615] netlink: 'syz.4.1074': attribute type 1 has an invalid length. [ 195.213644][ T9610] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 195.283258][ T9610] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 195.307947][ T9615] 8021q: adding VLAN 0 to HW filter on device bond14 [ 195.382100][ T9615] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1074'. [ 195.961143][ T9647] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.081552][ T9657] netlink: 'syz.0.1090': attribute type 1 has an invalid length. [ 196.283724][ T9657] 8021q: adding VLAN 0 to HW filter on device bond9 [ 196.301626][ T9647] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.365833][ T9647] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.436221][ T9647] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.598048][ T8233] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.623374][ T8233] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.677587][ T6155] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.756189][ T79] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.772741][ T9675] syz_tun: entered allmulticast mode [ 196.790423][ T9675] syz_tun: left allmulticast mode [ 196.955210][ T9688] bridge0: entered promiscuous mode [ 196.975132][ T9688] macvlan2: entered allmulticast mode [ 196.995403][ T9688] bridge0: entered allmulticast mode [ 197.011821][ T9688] bridge0: port 1(macvlan2) entered blocking state [ 197.047252][ T9688] bridge0: port 1(macvlan2) entered disabled state [ 197.110978][ T9688] bridge0: left allmulticast mode [ 197.119722][ T9688] bridge0: left promiscuous mode [ 197.317990][ T9701] netlink: 'syz.2.1103': attribute type 1 has an invalid length. [ 197.439268][ T9701] 8021q: adding VLAN 0 to HW filter on device bond11 [ 197.453583][ T9701] __nla_validate_parse: 5 callbacks suppressed [ 197.453600][ T9701] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1103'. [ 197.757350][ T9724] IPVS: set_ctl: invalid protocol: 0 10.1.1.2:20004 [ 197.940866][ T9727] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1108'. [ 197.950200][ T9727] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1108'. [ 198.327823][ T9735] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1111'. [ 198.533702][ T9741] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.764428][ T9747] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1116'. [ 198.987943][ T9752] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1118'. [ 199.050029][ T9753] netlink: 'syz.2.1118': attribute type 13 has an invalid length. [ 199.068822][ T9753] netlink: 'syz.2.1118': attribute type 17 has an invalid length. [ 199.143726][ T9753] lo: left promiscuous mode [ 199.187627][ T9757] netlink: 'syz.3.1119': attribute type 1 has an invalid length. [ 199.254564][ T9761] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1120'. [ 199.304097][ T9762] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1119'. [ 199.360375][ T9753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.381916][ T9753] 8021q: adding VLAN 0 to HW filter on device team0 [ 199.422321][ T9753] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 199.518322][ T9757] 8021q: adding VLAN 0 to HW filter on device bond7 [ 199.539181][ T9761] batadv0: entered promiscuous mode [ 199.545962][ T9761] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 199.554330][ T9761] batadv0: left promiscuous mode [ 200.105862][ T9779] netlink: 201592 bytes leftover after parsing attributes in process `syz.1.1126'. [ 200.120549][ T9778] netlink: 201592 bytes leftover after parsing attributes in process `syz.1.1126'. [ 200.533836][ T9793] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 201.219873][ T9826] netlink: 'syz.1.1135': attribute type 1 has an invalid length. [ 201.240120][ T9820] syz.4.1134 (9820) used obsolete PPPIOCDETACH ioctl [ 201.388195][ T9826] 8021q: adding VLAN 0 to HW filter on device bond13 [ 201.851940][ T9840] batadv0: entered promiscuous mode [ 201.859577][ T9840] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 201.869490][ T9840] batadv0: left promiscuous mode [ 202.291263][ T9858] netlink: 'syz.3.1152': attribute type 15 has an invalid length. [ 202.414747][ T1166] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 202.424214][ T9858] netlink: 'syz.3.1152': attribute type 15 has an invalid length. [ 202.485109][ T1166] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 202.516019][ T1166] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 202.546803][ T1166] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 202.687594][ T9874] __nla_validate_parse: 8 callbacks suppressed [ 202.687632][ T9874] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1155'. [ 202.812350][ T9886] netlink: 'syz.3.1156': attribute type 1 has an invalid length. [ 202.944024][ T9886] 8021q: adding VLAN 0 to HW filter on device bond8 [ 203.014223][ T9886] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1156'. [ 203.447506][ T9909] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1166'. [ 203.584693][ T9911] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1165'. [ 203.709578][ T9913] tipc: Can't bind to reserved service type 0 [ 203.711232][ T9916] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1169'. [ 204.079218][ T9943] netlink: 'syz.4.1173': attribute type 13 has an invalid length. [ 204.097733][ T9943] netlink: 'syz.4.1173': attribute type 17 has an invalid length. [ 204.589662][ T9961] netlink: 'syz.1.1181': attribute type 6 has an invalid length. [ 204.593948][ T9962] netlink: 'syz.0.1178': attribute type 1 has an invalid length. [ 204.706324][ T9968] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1178'. [ 204.737793][ T9966] netlink: 'syz.1.1181': attribute type 23 has an invalid length. [ 205.084797][ T9962] 8021q: adding VLAN 0 to HW filter on device bond10 [ 205.110591][ T9976] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1184'. [ 206.002740][T10019] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1195'. [ 206.418977][T10034] netlink: 'syz.1.1199': attribute type 1 has an invalid length. [ 206.539810][T10034] 8021q: adding VLAN 0 to HW filter on device bond14 [ 206.574402][T10041] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1199'. [ 207.033368][T10049] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1204'. [ 207.037016][T10051] netlink: 'syz.3.1203': attribute type 1 has an invalid length. [ 207.462327][T10058] team0: entered promiscuous mode [ 207.470704][T10058] bridge0: entered promiscuous mode [ 207.477291][T10058] debugfs: 'hsr1' already exists in 'hsr' [ 207.483060][T10058] Cannot create hsr debugfs directory [ 207.488834][T10058] hsr1: Slave A (team0) is not up; please bring it up to get a fully working HSR network [ 207.498888][T10058] hsr1: Slave B (bridge0) is not up; please bring it up to get a fully working HSR network [ 208.037377][T10084] netlink: 'syz.0.1216': attribute type 1 has an invalid length. [ 208.213605][T10094] __nla_validate_parse: 2 callbacks suppressed [ 208.213624][T10094] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1216'. [ 208.260115][T10084] 8021q: adding VLAN 0 to HW filter on device bond11 [ 208.329049][T10101] netlink: 'syz.1.1221': attribute type 1 has an invalid length. [ 208.449113][T10100] bond15: (slave vcan0): The slave device specified does not support setting the MAC address [ 208.459841][T10100] bond15: (slave vcan0): Setting fail_over_mac to active for active-backup mode [ 208.506644][T10100] bond15: (slave vcan0): making interface the new active one [ 208.516470][T10100] bond15: (slave vcan0): Enslaving as an active interface with an up link [ 208.543176][T10107] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1220'. [ 208.694418][T10111] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1223'. [ 208.757925][T10112] netlink: 'syz.3.1223': attribute type 13 has an invalid length. [ 208.776339][T10112] netlink: 'syz.3.1223': attribute type 17 has an invalid length. [ 208.872940][T10121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.976154][T10112] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 209.129480][T10125] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 209.169991][T10132] netlink: 136 bytes leftover after parsing attributes in process `syz.0.1230'. [ 209.190352][T10132] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 209.262910][T10137] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1232'. [ 209.339660][T10137] batadv0: entered promiscuous mode [ 209.354112][T10137] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 209.402155][T10137] batadv0: left promiscuous mode [ 209.469314][T10145] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1234'. [ 209.475914][T10144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1233'. [ 209.684023][T10153] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1237'. [ 209.800872][T10160] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1239'. [ 209.865993][T10161] netlink: 'syz.1.1238': attribute type 1 has an invalid length. [ 209.971491][T10164] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1238'. [ 210.090626][T10161] 8021q: adding VLAN 0 to HW filter on device bond16 [ 210.542759][T10191] bond0: entered promiscuous mode [ 210.552548][T10191] bond_slave_0: entered promiscuous mode [ 210.558670][T10191] bond_slave_1: entered promiscuous mode [ 210.566852][T10191] team0: entered promiscuous mode [ 210.571926][T10191] team_slave_0: entered promiscuous mode [ 210.578621][T10191] team_slave_1: entered promiscuous mode [ 210.597544][T10191] ip6gretap0: entered promiscuous mode [ 211.645199][T10244] netlink: 'syz.0.1260': attribute type 1 has an invalid length. [ 211.655754][ T5833] Bluetooth: hci0: command 0x0406 tx timeout [ 211.657850][ T5840] Bluetooth: hci2: command 0x0406 tx timeout [ 211.661941][ T5833] Bluetooth: hci3: command 0x0406 tx timeout [ 211.670237][ T5838] Bluetooth: hci1: command 0x0406 tx timeout [ 211.920470][T10244] 8021q: adding VLAN 0 to HW filter on device bond12 [ 212.282130][T10273] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 212.440326][T10279] netlink: 'syz.2.1269': attribute type 13 has an invalid length. [ 212.457433][T10279] netlink: 'syz.2.1269': attribute type 17 has an invalid length. [ 212.533376][T10279] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 212.631033][T10279] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.159842][T10298] bridge0: entered promiscuous mode [ 213.169285][T10298] macvlan2: entered allmulticast mode [ 213.179335][T10298] bridge0: entered allmulticast mode [ 213.194509][T10298] bridge0: port 1(macvlan2) entered blocking state [ 213.205823][T10298] bridge0: port 1(macvlan2) entered disabled state [ 213.240089][T10302] __nla_validate_parse: 10 callbacks suppressed [ 213.240108][T10302] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1277'. [ 213.280242][T10298] bridge0: left allmulticast mode [ 213.293687][T10298] bridge0: left promiscuous mode [ 213.328525][T10305] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1278'. [ 213.428830][T10305] batadv0: entered promiscuous mode [ 213.435907][T10305] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 213.449832][T10305] batadv0: left promiscuous mode [ 213.766593][T10315] netlink: 'syz.3.1280': attribute type 1 has an invalid length. [ 213.815278][T10314] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1281'. [ 213.852635][T10315] 8021q: adding VLAN 0 to HW filter on device bond9 [ 213.863498][T10321] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1279'. [ 213.884175][T10315] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1280'. [ 213.996298][T10327] netlink: 'syz.2.1283': attribute type 13 has an invalid length. [ 214.331896][T10334] netlink: 'syz.0.1286': attribute type 1 has an invalid length. [ 214.422037][T10334] 8021q: adding VLAN 0 to HW filter on device bond13 [ 214.481246][T10338] bond13: (slave ip6gretap1): making interface the new active one [ 214.507592][T10338] bond13: (slave ip6gretap1): Enslaving as an active interface with an up link [ 214.524668][T10339] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.1287'. [ 214.738274][T10334] veth3: entered promiscuous mode [ 214.747707][T10334] bond13: (slave veth3): Enslaving as an active interface with a down link [ 214.777484][T10340] erspan0: entered allmulticast mode [ 214.792345][T10340] bond13: (slave erspan0): Enslaving as an active interface with an up link [ 214.809814][T10338] bond13: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 214.952202][T10349] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1289'. [ 215.015085][T10351] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1290'. [ 215.100892][T10351] batadv0: entered promiscuous mode [ 215.112817][T10351] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 215.135293][T10351] batadv0: left promiscuous mode [ 215.505234][T10361] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1292'. [ 215.525806][T10357] netlink: 'syz.3.1292': attribute type 13 has an invalid length. [ 215.534307][T10357] netlink: 'syz.3.1292': attribute type 17 has an invalid length. [ 215.566224][T10357] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 215.694845][T10361] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 216.257738][T10376] netlink: 'syz.2.1299': attribute type 15 has an invalid length. [ 216.445012][T10379] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.564657][T10379] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.765400][T10379] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.923163][T10379] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.963415][T10406] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1310'. [ 217.170749][ T79] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.191824][T10410] netlink: 'syz.4.1311': attribute type 10 has an invalid length. [ 217.231891][T10410] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.297237][T10410] team0: entered promiscuous mode [ 217.313213][T10410] bond0: (slave team0): Enslaving as an active interface with an up link [ 217.455166][ T8233] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.517008][ T8233] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.565874][ T8233] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.786007][T10423] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 217.826282][T10423] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.113301][T10423] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 218.128470][T10423] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.300376][T10451] __nla_validate_parse: 3 callbacks suppressed [ 218.300395][T10451] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1325'. [ 218.326281][ T8230] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 218.334699][ T8230] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 218.410095][T10423] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 218.446243][T10423] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.475321][T10449] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1324'. [ 218.488446][T10449] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1324'. [ 218.602211][T10449] bond0: entered promiscuous mode [ 218.608383][T10449] bond_slave_0: entered promiscuous mode [ 218.636913][T10449] bond_slave_1: entered promiscuous mode [ 218.648023][T10449] ip6gretap0: entered promiscuous mode [ 218.654836][T10449] debugfs: 'hsr2' already exists in 'hsr' [ 218.711234][T10449] Cannot create hsr debugfs directory [ 218.743216][T10423] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 218.754604][T10423] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.025343][ T6155] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 2816 - 0 [ 219.049406][ T6155] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.109690][ T1166] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 2816 - 0 [ 219.125653][ T1166] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.289365][ T6155] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 2816 - 0 [ 219.314285][ T6155] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.348425][ T6155] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 2816 - 0 [ 219.372593][ T6155] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.566769][T10479] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1335'. [ 219.606511][T10479] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1335'. [ 219.607169][T10488] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1336'. [ 219.627466][T10487] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1337'. [ 219.727911][T10493] netlink: 'syz.2.1336': attribute type 3 has an invalid length. [ 219.969019][T10499] netlink: 'syz.2.1342': attribute type 12 has an invalid length. [ 220.082225][T10505] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1343'. [ 220.264003][T10505] batadv0: entered promiscuous mode [ 220.306717][T10505] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 220.354221][T10505] batadv0: left promiscuous mode [ 220.606414][T10518] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1348'. [ 220.752355][T10524] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1349'. [ 220.893617][T10527] netlink: 'syz.4.1351': attribute type 4 has an invalid length. [ 221.770710][T10549] batadv0: entered promiscuous mode [ 221.777803][T10549] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 221.789679][T10549] batadv0: left promiscuous mode [ 221.971375][T10552] @ÿ: renamed from veth0_vlan (while UP) [ 222.256915][T10566] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20001 [ 222.685832][T10575] bond0: entered promiscuous mode [ 222.692860][T10575] ip6gretap0: entered promiscuous mode [ 222.699936][T10575] debugfs: 'hsr2' already exists in 'hsr' [ 222.706128][T10575] Cannot create hsr debugfs directory [ 222.711857][T10575] hsr2: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 223.407843][T10597] syzkaller0: entered promiscuous mode [ 223.413605][T10597] syzkaller0: entered allmulticast mode [ 225.717058][T10619] __nla_validate_parse: 10 callbacks suppressed [ 225.717079][T10619] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1376'. [ 225.762006][T10620] --map-set only usable from mangle table [ 225.821490][T10619] netlink: 'syz.1.1376': attribute type 13 has an invalid length. [ 225.829628][T10619] netlink: 'syz.1.1376': attribute type 17 has an invalid length. [ 225.880312][T10626] --map-set only usable from mangle table [ 226.013446][T10633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 226.049660][T10635] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1379'. [ 226.064907][T10636] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1377'. [ 226.077662][T10619] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 226.093838][ T30] audit: type=1800 audit(1763451232.490:4): pid=10638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1380" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=1300 res=0 errno=0 [ 226.129867][ T30] audit: type=1800 audit(1763451232.510:5): pid=10638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1380" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=1300 res=0 errno=0 [ 226.177923][T10624] netlink: 'syz.2.1377': attribute type 13 has an invalid length. [ 226.199239][T10624] netlink: 'syz.2.1377': attribute type 17 has an invalid length. [ 226.398220][T10624] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 226.619852][T10651] syzkaller1: entered promiscuous mode [ 226.626214][T10651] syzkaller1: entered allmulticast mode [ 226.700465][T10623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 226.716383][T10646] syzkaller1: left promiscuous mode [ 226.721702][T10646] syzkaller1: left allmulticast mode [ 226.761793][T10664] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1386'. [ 227.231317][ T30] audit: type=1800 audit(1763451233.630:6): pid=10679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1390" name=CB dev="tmpfs" ino=1473 res=0 errno=0 [ 227.444685][T10681] syzkaller1: entered promiscuous mode [ 227.462121][T10681] syzkaller1: entered allmulticast mode [ 227.480784][T10683] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1392'. [ 227.485100][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1391'. [ 227.881171][T10694] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1396'. [ 228.039116][T10694] batadv0: entered promiscuous mode [ 228.049577][T10694] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 228.060410][T10694] batadv0: left promiscuous mode [ 228.266076][ T8233] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0xc9 [ 228.716909][T10717] ieee802154 phy0 wpan0: encryption failed: -22 [ 228.898885][T10729] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1405'. [ 228.913328][T10728] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1404'. [ 229.012231][T10728] bridge0: entered promiscuous mode [ 229.033752][T10728] macvlan2: entered allmulticast mode [ 229.042402][T10728] bridge0: entered allmulticast mode [ 229.050282][T10728] bridge0: port 1(macvlan2) entered blocking state [ 229.057734][T10728] bridge0: port 1(macvlan2) entered disabled state [ 229.136837][T10728] bridge0: left allmulticast mode [ 229.151097][T10728] bridge0: left promiscuous mode [ 229.482047][T10744] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 229.652894][T10748] netlink: 23 bytes leftover after parsing attributes in process `syz.3.1409'. [ 229.681771][T10747] batadv0: entered promiscuous mode [ 229.689126][T10747] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 229.698359][T10747] batadv0: left promiscuous mode [ 229.824730][T10751] Unsupported ieee802154 address type: 0 [ 230.481983][T10769] bridge0: entered promiscuous mode [ 230.509379][T10769] macvlan2: entered allmulticast mode [ 230.540811][T10769] bridge0: entered allmulticast mode [ 230.579552][T10769] bridge0: port 1(macvlan2) entered blocking state [ 230.609166][T10769] bridge0: port 1(macvlan2) entered disabled state [ 230.629354][T10769] bridge0: left allmulticast mode [ 230.643668][T10769] bridge0: left promiscuous mode [ 230.786965][T10779] __nla_validate_parse: 5 callbacks suppressed [ 230.786986][T10779] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1423'. [ 230.880283][T10779] batadv0: entered promiscuous mode [ 230.897403][T10779] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 230.922934][T10779] batadv0: left promiscuous mode [ 231.020920][T10788] dummy0: entered promiscuous mode [ 231.024904][T10786] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1426'. [ 231.026446][T10788] dummy0: entered allmulticast mode [ 231.068696][T10790] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.131160][T10795] netlink: 'syz.2.1426': attribute type 13 has an invalid length. [ 231.139565][T10795] netlink: 'syz.2.1426': attribute type 17 has an invalid length. [ 231.288991][T10786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 231.308719][T10795] 8021q: adding VLAN 0 to HW filter on device team0 [ 231.345368][T10795] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 231.409121][T10790] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.425276][T10813] netlink: 'syz.3.1434': attribute type 1 has an invalid length. [ 231.528595][T10813] 8021q: adding VLAN 0 to HW filter on device bond10 [ 231.581836][T10820] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1436'. [ 231.664454][T10818] bond10: (slave veth3): Enslaving as an active interface with a down link [ 231.677596][T10824] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1437'. [ 231.714419][T10822] xt_ecn: cannot match TCP bits for non-tcp packets [ 231.721524][T10820] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1436'. [ 231.761061][T10790] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.796253][T10813] bond10: entered allmulticast mode [ 231.851633][T10790] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.869056][T10828] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1448'. [ 232.123542][T10836] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1441'. [ 232.192988][T10830] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1439'. [ 232.276014][T10836] batadv0: entered promiscuous mode [ 232.283356][T10836] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 232.322973][T10836] batadv0: left promiscuous mode [ 232.399768][ T6155] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.548220][ T8230] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.600646][ T49] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.628523][T10844] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1443'. [ 232.654792][ T1166] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.903134][T10858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1449'. [ 233.161699][T10866] bridge0: entered promiscuous mode [ 233.167218][T10866] macvlan2: entered allmulticast mode [ 233.172780][T10866] bridge0: entered allmulticast mode [ 233.180688][T10866] bridge0: port 1(macvlan2) entered blocking state [ 233.187880][T10866] bridge0: port 1(macvlan2) entered disabled state [ 233.206174][T10866] bridge0: left allmulticast mode [ 233.211501][T10866] bridge0: left promiscuous mode [ 233.568146][T10874] batadv0: entered promiscuous mode [ 233.590855][T10874] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 233.644999][T10874] batadv0: left promiscuous mode [ 234.047072][T10893] netlink: 'syz.1.1461': attribute type 5 has an invalid length. [ 234.054585][T10894] netlink: 'syz.1.1461': attribute type 5 has an invalid length. [ 234.075015][T10893] netlink: 'syz.1.1461': attribute type 17 has an invalid length. [ 234.109861][T10894] netlink: 'syz.1.1461': attribute type 17 has an invalid length. [ 234.269587][T10904] lo: left promiscuous mode [ 234.370274][T10904] dummy0: left promiscuous mode [ 234.375265][T10904] dummy0: left allmulticast mode [ 234.548231][T10904] vlan2: left promiscuous mode [ 234.553069][T10904] bond0: left promiscuous mode [ 234.559688][T10904] team0: left promiscuous mode [ 234.613749][T10904] bond9: left promiscuous mode [ 234.619433][T10904] bond9: left allmulticast mode [ 234.645081][T10908] hsr_slave_0: left promiscuous mode [ 234.670475][T10908] hsr_slave_1: left promiscuous mode [ 234.736361][ T1166] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.764198][ T1166] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.804458][ T1166] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.834019][ T1166] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.969957][T10919] netlink: 'syz.2.1466': attribute type 1 has an invalid length. [ 235.615153][T10938] syzkaller0: entered promiscuous mode [ 235.621060][T10938] syzkaller0: entered allmulticast mode [ 235.731755][T10944] TCP: TCP_TX_DELAY enabled [ 236.094322][T10952] __nla_validate_parse: 15 callbacks suppressed [ 236.094343][T10952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1480'. [ 236.378008][T10956] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1482'. [ 237.249896][T10946] batadv0: entered promiscuous mode [ 237.257083][T10946] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 237.265910][T10946] batadv0: left promiscuous mode [ 237.296366][T10957] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 237.518237][T10965] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1484'. [ 237.566050][T10965] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1484'. [ 237.630579][T10972] netlink: 'syz.0.1489': attribute type 13 has an invalid length. [ 237.826323][T10972] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.834276][T10972] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.934630][T10990] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1494'. [ 237.990417][T10972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.006988][T10972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 238.010322][T10991] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1493'. [ 238.024217][T10991] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1493'. [ 238.048184][T10994] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1494'. [ 238.271980][ T6155] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.284209][ T6155] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.298990][ T6155] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.319616][ T6155] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.173318][T11008] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1497'. [ 239.182522][T11008] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1497'. [ 240.331119][T11027] batadv0: entered promiscuous mode [ 240.338098][T11027] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 240.389833][T11027] batadv0: left promiscuous mode [ 240.673349][ T8233] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.713055][ T8233] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.765646][ T8233] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.782210][ T8233] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.171948][T11060] __nla_validate_parse: 7 callbacks suppressed [ 241.171967][T11060] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1515'. [ 241.206252][T11062] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1516'. [ 241.660302][T11076] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1520'. [ 241.679895][T11076] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1520'. [ 241.754621][T11078] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1522'. [ 241.990758][T11078] batadv0: entered promiscuous mode [ 241.998147][T11078] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 242.034014][T11078] batadv0: left promiscuous mode [ 242.286927][T11088] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1525'. [ 242.429430][T11092] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1526'. [ 242.762229][T11106] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1532'. [ 242.774155][T11105] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1532'. [ 244.120924][T11141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1541'. [ 246.517685][T11198] IPVS: set_ctl: invalid protocol: 0 10.1.1.2:20004 [ 246.606675][T11199] netlink: 'syz.1.1562': attribute type 10 has an invalid length. [ 246.665858][T11199] veth0_vlan: entered allmulticast mode [ 246.777854][T11199] veth0_vlan: left promiscuous mode [ 246.784612][T11199] veth0_vlan: entered promiscuous mode [ 246.796464][T11199] team0: Device veth0_vlan failed to register rx_handler [ 246.839121][T11204] __nla_validate_parse: 11 callbacks suppressed [ 246.839139][T11204] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1564'. [ 246.942733][T11204] macvlan2: entered allmulticast mode [ 246.962624][T11204] bridge0: entered allmulticast mode [ 247.014392][T11204] bridge0: port 1(macvlan2) entered blocking state [ 247.141517][T11204] bridge0: port 1(macvlan2) entered disabled state [ 247.293769][T11204] bridge0: left allmulticast mode [ 247.566366][T11214] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1568'. [ 247.617346][T11215] syz_tun: entered allmulticast mode [ 247.711835][T11211] syz_tun: left allmulticast mode [ 248.450149][T11231] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20000 [ 248.568597][T11229] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1573'. [ 249.699747][T11251] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1579'. [ 249.739831][T11251] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1579'. [ 252.749670][T11289] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1590'. [ 252.760505][T11289] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1590'. [ 252.966299][T11289] bond0: entered promiscuous mode [ 252.982658][T11289] team0: entered promiscuous mode [ 252.994325][T11289] ip6gretap0: entered promiscuous mode [ 253.001506][T11289] debugfs: 'hsr0' already exists in 'hsr' [ 253.007816][T11289] Cannot create hsr debugfs directory [ 253.013405][T11289] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 253.070584][T11289] hsr0: Slave B (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 253.169421][T11294] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1592'. [ 254.011339][T11304] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1597'. [ 254.161386][T11306] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1598'. [ 254.270366][T11306] batadv0: entered promiscuous mode [ 254.294751][T11306] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 254.343231][T11306] batadv0: left promiscuous mode [ 255.456113][T11329] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1606'. [ 255.669737][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.698593][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.752586][T11337] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1607'. [ 256.455307][T11347] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1613'. [ 256.507046][T11347] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1613'. [ 256.813310][T11363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1619'. [ 257.872291][T11379] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1624'. [ 258.123355][T11387] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1627'. [ 258.334874][T11392] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1627'. [ 258.695283][T11390] bond13: (slave geneve3): Enslaving as an active interface with an up link [ 258.732441][ T6155] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.824290][ T6155] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.861882][ T6155] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.926463][ T6155] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 259.229135][T11415] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1636'. [ 259.485747][T11420] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1638'. [ 259.628525][T11420] macvlan2: entered allmulticast mode [ 259.644060][T11420] bridge0: entered allmulticast mode [ 259.668600][T11420] bridge0: port 1(macvlan2) entered blocking state [ 259.692237][T11420] bridge0: port 1(macvlan2) entered disabled state [ 259.746672][T11420] bridge0: left allmulticast mode [ 260.544055][T11436] netlink: 'syz.4.1645': attribute type 49 has an invalid length. [ 261.263853][T11449] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1651'. [ 261.363264][T11452] unsupported nla_type 52263 [ 261.577619][T11451] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1649'. [ 262.696510][T11469] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1658'. [ 263.622026][T11484] FAULT_INJECTION: forcing a failure. [ 263.622026][T11484] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 263.815038][T11484] CPU: 0 UID: 0 PID: 11484 Comm: syz.4.1664 Not tainted syzkaller #0 PREEMPT(full) [ 263.815064][T11484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 263.815089][T11484] Call Trace: [ 263.815098][T11484] [ 263.815106][T11484] dump_stack_lvl+0x189/0x250 [ 263.815139][T11484] ? __pfx____ratelimit+0x10/0x10 [ 263.815169][T11484] ? __pfx_dump_stack_lvl+0x10/0x10 [ 263.815195][T11484] ? __pfx__printk+0x10/0x10 [ 263.815227][T11484] should_fail_ex+0x414/0x560 [ 263.815261][T11484] _copy_to_user+0x31/0xb0 [ 263.815288][T11484] simple_read_from_buffer+0xe1/0x170 [ 263.815322][T11484] proc_fail_nth_read+0x1b3/0x220 [ 263.815350][T11484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 263.815377][T11484] ? rw_verify_area+0x2a6/0x4d0 [ 263.815403][T11484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 263.815428][T11484] vfs_read+0x200/0xa30 [ 263.815453][T11484] ? __pfx_aa_sk_perm+0x10/0x10 [ 263.815486][T11484] ? __pfx_vfs_read+0x10/0x10 [ 263.815515][T11484] ? bpf_lsm_socket_connect+0x9/0x20 [ 263.815537][T11484] ? __sys_connect+0x339/0x440 [ 263.815557][T11484] ? do_sys_openat2+0x154/0x1c0 [ 263.815586][T11484] ? __pfx___sys_connect+0x10/0x10 [ 263.815612][T11484] ksys_read+0x145/0x250 [ 263.815660][T11484] ? __pfx_ksys_read+0x10/0x10 [ 263.815692][T11484] ? do_syscall_64+0xbe/0xfa0 [ 263.815716][T11484] do_syscall_64+0xfa/0xfa0 [ 263.815735][T11484] ? lockdep_hardirqs_on+0x9c/0x150 [ 263.815755][T11484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.815775][T11484] ? clear_bhb_loop+0x60/0xb0 [ 263.815799][T11484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.815819][T11484] RIP: 0033:0x7fbf7198e0dc [ 263.815838][T11484] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 263.815855][T11484] RSP: 002b:00007fbf72767030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 263.815878][T11484] RAX: ffffffffffffffda RBX: 00007fbf71be5fa0 RCX: 00007fbf7198e0dc [ 263.815892][T11484] RDX: 000000000000000f RSI: 00007fbf727670a0 RDI: 0000000000000003 [ 263.815905][T11484] RBP: 00007fbf72767090 R08: 0000000000000000 R09: 0000000000000000 [ 263.815917][T11484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.815929][T11484] R13: 00007fbf71be6038 R14: 00007fbf71be5fa0 R15: 00007ffe03f1d248 [ 263.815963][T11484] [ 264.910935][T11495] syzkaller1: entered promiscuous mode [ 264.932499][T11495] syzkaller1: entered allmulticast mode [ 265.278176][T11506] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1670'. [ 265.291280][T11510] netlink: 'syz.0.1671': attribute type 1 has an invalid length. [ 265.310969][T11506] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1670'. [ 265.326231][T11510] batadv1: entered promiscuous mode [ 265.333074][T11510] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 266.136963][T11521] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1676'. [ 267.010983][T11540] FAULT_INJECTION: forcing a failure. [ 267.010983][T11540] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 267.114055][T11540] CPU: 0 UID: 0 PID: 11540 Comm: syz.0.1681 Not tainted syzkaller #0 PREEMPT(full) [ 267.114085][T11540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 267.114098][T11540] Call Trace: [ 267.114106][T11540] [ 267.114114][T11540] dump_stack_lvl+0x189/0x250 [ 267.114148][T11540] ? __pfx____ratelimit+0x10/0x10 [ 267.114180][T11540] ? __pfx_dump_stack_lvl+0x10/0x10 [ 267.114208][T11540] ? __pfx__printk+0x10/0x10 [ 267.114229][T11540] ? __might_fault+0xb0/0x130 [ 267.114271][T11540] should_fail_ex+0x414/0x560 [ 267.114308][T11540] _copy_from_user+0x2d/0xb0 [ 267.114336][T11540] __sys_bpf+0x1e3/0x860 [ 267.114359][T11540] ? __pfx___sys_bpf+0x10/0x10 [ 267.114404][T11540] ? ksys_write+0x22a/0x250 [ 267.114436][T11540] ? __pfx_ksys_write+0x10/0x10 [ 267.114471][T11540] __x64_sys_bpf+0x7c/0x90 [ 267.114502][T11540] do_syscall_64+0xfa/0xfa0 [ 267.114521][T11540] ? lockdep_hardirqs_on+0x9c/0x150 [ 267.114540][T11540] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.114560][T11540] ? clear_bhb_loop+0x60/0xb0 [ 267.114585][T11540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.114604][T11540] RIP: 0033:0x7fb0e4d8f6c9 [ 267.114622][T11540] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 267.114640][T11540] RSP: 002b:00007fb0e5b9a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 267.114661][T11540] RAX: ffffffffffffffda RBX: 00007fb0e4fe5fa0 RCX: 00007fb0e4d8f6c9 [ 267.114676][T11540] RDX: 0000000000000090 RSI: 0000200000000880 RDI: 0000000000000005 [ 267.114689][T11540] RBP: 00007fb0e5b9a090 R08: 0000000000000000 R09: 0000000000000000 [ 267.114701][T11540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 267.114713][T11540] R13: 00007fb0e4fe6038 R14: 00007fb0e4fe5fa0 R15: 00007ffde4213ba8 [ 267.114745][T11540] [ 268.767948][T11564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1690'. [ 269.096239][T11573] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1694'. [ 270.086522][T11587] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1699'. [ 270.096222][T11587] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1699'. [ 270.106369][T11604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1703'. [ 270.890590][T11615] FAULT_INJECTION: forcing a failure. [ 270.890590][T11615] name failslab, interval 1, probability 0, space 0, times 0 [ 270.910878][T11615] CPU: 0 UID: 0 PID: 11615 Comm: syz.3.1707 Not tainted syzkaller #0 PREEMPT(full) [ 270.910907][T11615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 270.910919][T11615] Call Trace: [ 270.910928][T11615] [ 270.910936][T11615] dump_stack_lvl+0x189/0x250 [ 270.910969][T11615] ? __pfx____ratelimit+0x10/0x10 [ 270.911001][T11615] ? __pfx_dump_stack_lvl+0x10/0x10 [ 270.911029][T11615] ? __pfx__printk+0x10/0x10 [ 270.911056][T11615] ? __pfx___might_resched+0x10/0x10 [ 270.911077][T11615] ? fs_reclaim_acquire+0x7d/0x100 [ 270.911102][T11615] should_fail_ex+0x414/0x560 [ 270.911139][T11615] should_failslab+0xa8/0x100 [ 270.911161][T11615] __kmalloc_cache_node_noprof+0x74/0x6f0 [ 270.911192][T11615] ? __get_vm_area_node+0x13f/0x300 [ 270.911226][T11615] __get_vm_area_node+0x13f/0x300 [ 270.911267][T11615] __vmalloc_node_range_noprof+0x30c/0x12d0 [ 270.911298][T11615] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 270.911322][T11615] ? __lock_acquire+0xab9/0xd20 [ 270.911356][T11615] ? __lock_acquire+0xab9/0xd20 [ 270.911383][T11615] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 270.911415][T11615] ? __might_fault+0xb0/0x130 [ 270.911451][T11615] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 270.911470][T11615] __vmalloc_noprof+0xb1/0xf0 [ 270.911498][T11615] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 270.911522][T11615] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 270.911548][T11615] bpf_prog_alloc+0x3c/0x1a0 [ 270.911572][T11615] bpf_prog_load+0x735/0x19e0 [ 270.911605][T11615] ? __pfx_bpf_prog_load+0x10/0x10 [ 270.911650][T11615] ? bpf_lsm_bpf+0x9/0x20 [ 270.911672][T11615] ? security_bpf+0x7e/0x300 [ 270.911702][T11615] __sys_bpf+0x507/0x860 [ 270.911724][T11615] ? __pfx___sys_bpf+0x10/0x10 [ 270.911760][T11615] ? ksys_write+0x22a/0x250 [ 270.911792][T11615] ? __pfx_ksys_write+0x10/0x10 [ 270.911826][T11615] __x64_sys_bpf+0x7c/0x90 [ 270.911857][T11615] do_syscall_64+0xfa/0xfa0 [ 270.911875][T11615] ? lockdep_hardirqs_on+0x9c/0x150 [ 270.911894][T11615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.911914][T11615] ? clear_bhb_loop+0x60/0xb0 [ 270.911939][T11615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.911958][T11615] RIP: 0033:0x7f2e2358f6c9 [ 270.911976][T11615] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 270.911994][T11615] RSP: 002b:00007f2e243b7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 270.912016][T11615] RAX: ffffffffffffffda RBX: 00007f2e237e5fa0 RCX: 00007f2e2358f6c9 [ 270.912031][T11615] RDX: 0000000000000090 RSI: 0000200000000880 RDI: 0000000000000005 [ 270.912045][T11615] RBP: 00007f2e243b7090 R08: 0000000000000000 R09: 0000000000000000 [ 270.912057][T11615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 270.912069][T11615] R13: 00007f2e237e6038 R14: 00007f2e237e5fa0 R15: 00007ffe6692b888 [ 270.912102][T11615] [ 270.912114][T11615] syz.3.1707: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 271.247095][T11615] CPU: 0 UID: 0 PID: 11615 Comm: syz.3.1707 Not tainted syzkaller #0 PREEMPT(full) [ 271.247122][T11615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 271.247134][T11615] Call Trace: [ 271.247142][T11615] [ 271.247150][T11615] dump_stack_lvl+0x189/0x250 [ 271.247187][T11615] ? __pfx_dump_stack_lvl+0x10/0x10 [ 271.247216][T11615] ? __pfx__printk+0x10/0x10 [ 271.247237][T11615] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 271.247267][T11615] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 271.247298][T11615] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 271.247329][T11615] warn_alloc+0x214/0x310 [ 271.247368][T11615] ? __pfx_warn_alloc+0x10/0x10 [ 271.247408][T11615] ? __get_vm_area_node+0x2b5/0x300 [ 271.247443][T11615] __vmalloc_node_range_noprof+0x331/0x12d0 [ 271.247477][T11615] ? __lock_acquire+0xab9/0xd20 [ 271.247512][T11615] ? __lock_acquire+0xab9/0xd20 [ 271.247539][T11615] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 271.247570][T11615] ? __might_fault+0xb0/0x130 [ 271.247611][T11615] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 271.247632][T11615] __vmalloc_noprof+0xb1/0xf0 [ 271.247661][T11615] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 271.247704][T11615] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 271.247731][T11615] bpf_prog_alloc+0x3c/0x1a0 [ 271.247755][T11615] bpf_prog_load+0x735/0x19e0 [ 271.247789][T11615] ? __pfx_bpf_prog_load+0x10/0x10 [ 271.247836][T11615] ? bpf_lsm_bpf+0x9/0x20 [ 271.247860][T11615] ? security_bpf+0x7e/0x300 [ 271.247891][T11615] __sys_bpf+0x507/0x860 [ 271.247914][T11615] ? __pfx___sys_bpf+0x10/0x10 [ 271.247952][T11615] ? ksys_write+0x22a/0x250 [ 271.247992][T11615] ? __pfx_ksys_write+0x10/0x10 [ 271.248028][T11615] __x64_sys_bpf+0x7c/0x90 [ 271.248060][T11615] do_syscall_64+0xfa/0xfa0 [ 271.248080][T11615] ? lockdep_hardirqs_on+0x9c/0x150 [ 271.248101][T11615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.248121][T11615] ? clear_bhb_loop+0x60/0xb0 [ 271.248147][T11615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.248167][T11615] RIP: 0033:0x7f2e2358f6c9 [ 271.248185][T11615] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 271.248204][T11615] RSP: 002b:00007f2e243b7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 271.248227][T11615] RAX: ffffffffffffffda RBX: 00007f2e237e5fa0 RCX: 00007f2e2358f6c9 [ 271.248242][T11615] RDX: 0000000000000090 RSI: 0000200000000880 RDI: 0000000000000005 [ 271.248255][T11615] RBP: 00007f2e243b7090 R08: 0000000000000000 R09: 0000000000000000 [ 271.248268][T11615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 271.248281][T11615] R13: 00007f2e237e6038 R14: 00007f2e237e5fa0 R15: 00007ffe6692b888 [ 271.248316][T11615] [ 271.248325][T11615] Mem-Info: [ 272.048634][T11615] active_anon:5939 inactive_anon:0 isolated_anon:0 [ 272.048634][T11615] active_file:3403 inactive_file:39955 isolated_file:0 [ 272.048634][T11615] unevictable:768 dirty:98 writeback:0 [ 272.048634][T11615] slab_reclaimable:11414 slab_unreclaimable:191261 [ 272.048634][T11615] mapped:30694 shmem:1364 pagetables:1250 [ 272.048634][T11615] sec_pagetables:0 bounce:0 [ 272.048634][T11615] kernel_misc_reclaimable:0 [ 272.048634][T11615] free:1217732 free_pcp:27777 free_cma:0 [ 272.228029][T11615] Node 0 active_anon:23856kB inactive_anon:0kB active_file:13612kB inactive_file:159616kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122776kB dirty:392kB writeback:0kB shmem:3920kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14948kB pagetables:4828kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 272.280057][T11615] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 272.367877][T11615] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 272.482675][T11615] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 272.499470][T11615] Node 0 DMA32 free:963580kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23656kB inactive_anon:0kB active_file:13612kB inactive_file:159616kB unevictable:1536kB writepending:392kB zspages:0kB present:3129332kB managed:2565108kB mlocked:0kB bounce:0kB free_pcp:92908kB local_pcp:48252kB free_cma:0kB [ 272.596497][T11615] lowmem_reserve[]: 0 0 0 0 0 [ 272.606466][T11615] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 272.749948][T11615] lowmem_reserve[]: 0 0 0 0 0 [ 272.774542][T11615] Node 1 Normal free:3893004kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:18792kB local_pcp:6824kB free_cma:0kB [ 272.893132][T11615] lowmem_reserve[]: 0 0 0 0 0 [ 272.912705][T11615] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 272.984436][T11615] Node 0 DMA32: 516*4kB (UM) 613*8kB (UME) 341*16kB (UME) 513*32kB (UME) 146*64kB (UME) 80*128kB (UME) 31*256kB (UM) 15*512kB (UME) 4*1024kB (UM) 4*2048kB (UM) 218*4096kB (M) = 969256kB [ 273.099030][T11615] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 273.199845][T11615] Node 1 Normal: 159*4kB (UE) 64*8kB (UME) 51*16kB (UME) 81*32kB (UME) 23*64kB (UME) 7*128kB (UME) 6*256kB (ME) 5*512kB (UME) 3*1024kB (UME) 0*2048kB 947*4096kB (UM) = 3893004kB [ 273.292891][T11615] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 273.348960][T11615] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 273.424211][T11615] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 273.476975][T11615] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 273.524266][T11615] 44718 total pagecache pages [ 273.552804][T11615] 0 pages in swap cache [ 273.616190][T11615] Free swap = 124996kB [ 273.624598][T11615] Total swap = 124996kB [ 273.639087][T11615] 2097051 pages RAM [ 273.642968][T11615] 0 pages HighMem/MovableOnly [ 273.690569][T11615] 424132 pages reserved [ 273.694791][T11615] 0 pages cma reserved [ 273.838542][T11643] syzkaller0: entered promiscuous mode [ 273.861055][T11643] syzkaller0: entered allmulticast mode [ 274.029383][T11651] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1721'. [ 277.091679][T11658] bridge0: port 1(hsr0) entered blocking state [ 277.165142][T11658] bridge0: port 1(hsr0) entered disabled state [ 277.207557][T11658] hsr0: entered allmulticast mode [ 277.232084][T11658] hsr_slave_0: entered allmulticast mode [ 277.252101][T11658] hsr_slave_1: entered allmulticast mode [ 277.277379][T11658] hsr0: entered promiscuous mode [ 277.294318][T11658] bridge0: port 1(hsr0) entered blocking state [ 277.300956][T11658] bridge0: port 1(hsr0) entered forwarding state [ 277.465761][ C1] [ 277.468150][ C1] ============================================ [ 277.474315][ C1] WARNING: possible recursive locking detected [ 277.480494][ C1] syzkaller #0 Not tainted [ 277.484918][ C1] -------------------------------------------- [ 277.491077][ C1] syz.0.1728/11669 is trying to acquire lock: [ 277.497149][ C1] ffff88805c2fef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 277.506254][ C1] [ 277.506254][ C1] but task is already holding lock: [ 277.513631][ C1] ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 277.523933][ C1] [ 277.523933][ C1] other info that might help us debug this: [ 277.532007][ C1] Possible unsafe locking scenario: [ 277.532007][ C1] [ 277.539467][ C1] CPU0 [ 277.542756][ C1] ---- [ 277.546043][ C1] lock(&hsr->seqnr_lock); [ 277.550565][ C1] lock(&hsr->seqnr_lock); [ 277.555084][ C1] [ 277.555084][ C1] *** DEADLOCK *** [ 277.555084][ C1] [ 277.563228][ C1] May be due to missing lock nesting notation [ 277.563228][ C1] [ 277.571553][ C1] 11 locks held by syz.0.1728/11669: [ 277.576849][ C1] #0: ffff888026d1b7a0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x211/0x4d0 [ 277.586292][ C1] #1: ffff88814df98420 (sb_writers#4){.+.+}-{0:0}, at: ext4_file_mmap_prepare+0x24d/0x440 [ 277.596409][ C1] #2: ffffffff8e05e468 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 277.606030][ C1] #3: ffffc90000a08be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 [ 277.616079][ C1] #4: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x83/0x360 [ 277.625302][ C1] #5: ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 277.636065][ C1] #6: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 [ 277.645618][ C1] #7: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x284/0x3740 [ 277.655595][ C1] #8: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x185/0x1840 [ 277.664858][ C1] #9: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x284/0x3740 [ 277.674822][ C1] #10: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 277.684093][ C1] [ 277.684093][ C1] stack backtrace: [ 277.689996][ C1] CPU: 1 UID: 0 PID: 11669 Comm: syz.0.1728 Not tainted syzkaller #0 PREEMPT(full) [ 277.690040][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 277.690054][ C1] Call Trace: [ 277.690062][ C1] [ 277.690071][ C1] dump_stack_lvl+0x189/0x250 [ 277.690106][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 277.690136][ C1] ? __pfx__printk+0x10/0x10 [ 277.690163][ C1] print_deadlock_bug+0x28b/0x2a0 [ 277.690189][ C1] validate_chain+0x1a3f/0x2140 [ 277.690218][ C1] ? __lock_acquire+0xab9/0xd20 [ 277.690238][ C1] ? __pfx_skb_network_protocol+0x10/0x10 [ 277.690266][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 277.690293][ C1] __lock_acquire+0xab9/0xd20 [ 277.690317][ C1] ? hsr_dev_xmit+0x237/0x360 [ 277.690343][ C1] lock_acquire+0x120/0x360 [ 277.690362][ C1] ? hsr_dev_xmit+0x237/0x360 [ 277.690398][ C1] ? __lock_acquire+0xab9/0xd20 [ 277.690420][ C1] ? hsr_dev_xmit+0x237/0x360 [ 277.690445][ C1] _raw_spin_lock_bh+0x36/0x50 [ 277.690477][ C1] ? hsr_dev_xmit+0x237/0x360 [ 277.690503][ C1] hsr_dev_xmit+0x237/0x360 [ 277.690529][ C1] ? hsr_dev_xmit+0x2d/0x360 [ 277.690556][ C1] dev_hard_start_xmit+0x2d7/0x830 [ 277.690591][ C1] __dev_queue_xmit+0x172a/0x3740 [ 277.690617][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 277.690647][ C1] ? __dev_queue_xmit+0x284/0x3740 [ 277.690676][ C1] ? __local_bh_enable_ip+0x12d/0x1c0 [ 277.690700][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.690719][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 277.690745][ C1] ? __local_bh_enable_ip+0x12d/0x1c0 [ 277.690767][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 277.690793][ C1] ? do_raw_read_unlock+0x3d/0x80 [ 277.690822][ C1] ? ebt_do_table+0x265b/0x2820 [ 277.690844][ C1] ? __lock_acquire+0xab9/0xd20 [ 277.690878][ C1] br_dev_queue_push_xmit+0x6c5/0x890 [ 277.690911][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 277.690941][ C1] ? NF_HOOK+0x9e/0x3c0 [ 277.690968][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 277.690996][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 277.691024][ C1] NF_HOOK+0x320/0x3c0 [ 277.691053][ C1] ? NF_HOOK+0x9e/0x3c0 [ 277.691079][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 277.691107][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 277.691141][ C1] br_forward_finish+0xd3/0x130 [ 277.691168][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 277.691196][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 277.691223][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 277.691264][ C1] NF_HOOK+0x320/0x3c0 [ 277.691290][ C1] ? NF_HOOK+0x9e/0x3c0 [ 277.691314][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 277.691338][ C1] ? br_multicast_count+0xf2/0xdc0 [ 277.691368][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 277.691405][ C1] __br_forward+0x41e/0x600 [ 277.691430][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 277.691456][ C1] ? maybe_deliver+0xfe/0x160 [ 277.691483][ C1] ? __pfx___br_forward+0x10/0x10 [ 277.691513][ C1] ? br_dev_xmit+0x185/0x1840 [ 277.691531][ C1] br_dev_xmit+0x11b3/0x1840 [ 277.691550][ C1] ? br_dev_xmit+0x185/0x1840 [ 277.691571][ C1] ? __pfx_br_dev_xmit+0x10/0x10 [ 277.691590][ C1] ? __pfx_validate_xmit_xfrm+0x10/0x10 [ 277.691608][ C1] ? __pfx_netif_skb_features+0x10/0x10 [ 277.691632][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 277.691653][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 277.691678][ C1] ? validate_xmit_skb+0xd78/0x1500 [ 277.691706][ C1] dev_hard_start_xmit+0x2d7/0x830 [ 277.691737][ C1] __dev_queue_xmit+0x172a/0x3740 [ 277.691763][ C1] ? kasan_save_track+0x3e/0x80 [ 277.691795][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 277.691816][ C1] ? __dev_queue_xmit+0x284/0x3740 [ 277.691840][ C1] ? qlist_free_all+0x97/0x140 [ 277.691866][ C1] ? kasan_quarantine_reduce+0x148/0x160 [ 277.691894][ C1] ? kmem_cache_alloc_noprof+0x367/0x6e0 [ 277.691920][ C1] ? jbd2__journal_start+0x146/0x5b0 [ 277.691949][ C1] ? __ext4_journal_start_sb+0x227/0x5c0 [ 277.691970][ C1] ? ext4_dirty_inode+0x93/0x110 [ 277.691989][ C1] ? __mark_inode_dirty+0x2ec/0xe10 [ 277.692012][ C1] ? touch_atime+0x59b/0x6d0 [ 277.692032][ C1] ? ext4_file_mmap_prepare+0x24d/0x440 [ 277.692061][ C1] ? mmap_region+0xb47/0x2110 [ 277.692083][ C1] ? do_mmap+0xc45/0x10d0 [ 277.692107][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 277.692139][ C1] ? __copy_skb_header+0xa7/0x550 [ 277.692162][ C1] ? __asan_memcpy+0x40/0x70 [ 277.692192][ C1] ? hsr_addr_subst_dest+0x307/0xac0 [ 277.692219][ C1] ? skb_clone+0x246/0x3a0 [ 277.692243][ C1] hsr_forward_skb+0x158b/0x2860 [ 277.692278][ C1] ? hsr_forward_skb+0x9e/0x2860 [ 277.692308][ C1] ? __pfx_hsr_forward_skb+0x10/0x10 [ 277.692337][ C1] ? do_raw_spin_lock+0x121/0x290 [ 277.692366][ C1] ? __asan_memset+0x22/0x50 [ 277.692396][ C1] ? __skb_pad+0x405/0x610 [ 277.692423][ C1] send_hsr_supervision_frame+0x731/0xcb0 [ 277.692456][ C1] ? __pfx_send_hsr_supervision_frame+0x10/0x10 [ 277.692485][ C1] hsr_announce+0x1d5/0x360 [ 277.692511][ C1] ? hsr_announce+0x83/0x360 [ 277.692536][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 277.692566][ C1] call_timer_fn+0x17e/0x5f0 [ 277.692585][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 277.692610][ C1] ? call_timer_fn+0xbe/0x5f0 [ 277.692628][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 277.692651][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 277.692680][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.692697][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 277.692723][ C1] __run_timer_base+0x61a/0x860 [ 277.692759][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 277.692786][ C1] ? seqcount_lockdep_reader_access+0x15e/0x1c0 [ 277.692821][ C1] run_timer_softirq+0xb7/0x180 [ 277.692851][ C1] handle_softirqs+0x286/0x870 [ 277.692873][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 277.692896][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 277.692922][ C1] __irq_exit_rcu+0xca/0x1f0 [ 277.692943][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 277.692968][ C1] irq_exit_rcu+0x9/0x30 [ 277.692987][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 277.693018][ C1] [ 277.693026][ C1] [ 277.693033][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 277.693054][ C1] RIP: 0010:put_cpu_partial+0x234/0x2e0 [ 277.693079][ C1] Code: 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 90 0f 0b 90 e9 e7 fe ff ff e8 89 da 2b 09 41 f7 c5 00 02 00 00 74 b2 fb 4d 85 ff <75> b1 eb ba e8 73 da 2b 09 e9 4f fe ff ff 90 0f 0b 90 e9 66 ff ff [ 277.693096][ C1] RSP: 0018:ffffc90019e873a0 EFLAGS: 00000246 [ 277.693114][ C1] RAX: 5267c7927084d000 RBX: ffff8881416a28c0 RCX: 5267c7927084d000 [ 277.693129][ C1] RDX: 0000000000000007 RSI: ffffffff8d7102d8 RDI: ffffffff8bbf0760 [ 277.693143][ C1] RBP: 0000000000000001 R08: ffffffff8f7cfd77 R09: 1ffffffff1ef9fae [ 277.693157][ C1] R10: dffffc0000000000 R11: fffffbfff1ef9faf R12: 0000000000000001 [ 277.693170][ C1] R13: 0000000000000286 R14: ffff8880b8942a80 R15: 0000000000000000 [ 277.693194][ C1] __slab_free+0x2b9/0x390 [ 277.693218][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 277.693247][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 277.693277][ C1] ? __phys_addr+0xd3/0x180 [ 277.693304][ C1] qlist_free_all+0x97/0x140 [ 277.693333][ C1] kasan_quarantine_reduce+0x148/0x160 [ 277.693363][ C1] __kasan_slab_alloc+0x22/0x80 [ 277.693400][ C1] kmem_cache_alloc_noprof+0x367/0x6e0 [ 277.693428][ C1] ? jbd2__journal_start+0x146/0x5b0 [ 277.693460][ C1] jbd2__journal_start+0x146/0x5b0 [ 277.693492][ C1] __ext4_journal_start_sb+0x227/0x5c0 [ 277.693517][ C1] ext4_dirty_inode+0x93/0x110 [ 277.693539][ C1] ? __pfx_ext4_dirty_inode+0x10/0x10 [ 277.693559][ C1] __mark_inode_dirty+0x2ec/0xe10 [ 277.693583][ C1] ? ext4_file_mmap_prepare+0x24d/0x440 [ 277.693615][ C1] touch_atime+0x59b/0x6d0 [ 277.693636][ C1] ? ext4_file_mmap_prepare+0x24d/0x440 [ 277.693670][ C1] ext4_file_mmap_prepare+0x24d/0x440 [ 277.693703][ C1] mmap_region+0xb47/0x2110 [ 277.693735][ C1] ? __pfx_mmap_region+0x10/0x10 [ 277.693767][ C1] ? xas_find+0x842/0x990 [ 277.693805][ C1] ? mt_find+0x5be/0x5e0 [ 277.693825][ C1] ? mt_find+0x15c/0x5e0 [ 277.693844][ C1] ? __pfx_mt_find+0x10/0x10 [ 277.693868][ C1] ? shmem_mapping+0xd/0x50 [ 277.693890][ C1] ? memfd_check_seals_mmap+0xc5/0x200 [ 277.693914][ C1] do_mmap+0xc45/0x10d0 [ 277.693945][ C1] ? __pfx_do_mmap+0x10/0x10 [ 277.693968][ C1] ? down_write_killable+0x178/0x230 [ 277.693993][ C1] ? __pfx_down_write_killable+0x10/0x10 [ 277.694015][ C1] ? common_file_perm+0x1b5/0x230 [ 277.694048][ C1] vm_mmap_pgoff+0x2a6/0x4d0 [ 277.694075][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 277.694095][ C1] ? __fget_files+0x2a/0x420 [ 277.694114][ C1] ? __fget_files+0x2a/0x420 [ 277.694132][ C1] ? __fget_files+0x2a/0x420 [ 277.694151][ C1] ksys_mmap_pgoff+0x51f/0x760 [ 277.694181][ C1] do_syscall_64+0xfa/0xfa0 [ 277.694199][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.694217][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.694236][ C1] ? clear_bhb_loop+0x60/0xb0 [ 277.694258][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.694277][ C1] RIP: 0033:0x7fb0e4d8f703 [ 277.694294][ C1] Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7 [ 277.694310][ C1] RSP: 002b:00007ffde4213cd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 277.694331][ C1] RAX: ffffffffffffffda RBX: 0000001b30464000 RCX: 00007fb0e4d8f703 [ 277.694345][ C1] RDX: 0000000000000003 RSI: 00000000005c0000 RDI: 0000001b30464000 [ 277.694358][ C1] RBP: 0000000000600000 R08: 0000000000000004 R09: 0000000000040000 [ 277.694370][ C1] R10: 0000000000100001 R11: 0000000000000246 R12: 0000000000000176 [ 277.694389][ C1] R13: 00000000000927c0 R14: 0000000000043aeb R15: 00007ffde4213fc0 [ 277.694412][ C1]